Gv Lpc2011 Lpc2211
Monthly
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen.
Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface.
Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis.
Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated Guest-level user to overwrite the device's administrative configuration and replace the administrator password via the SSVR service, resulting in full device takeover. The root cause is CWE-862 (Missing Authorization): the SSVR service does not enforce authorization boundaries between the Guest role and administrator-level configuration operations. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and low privilege bar make this a meaningful risk in any deployment where Guest accounts are enabled or accessible.
Privilege escalation in GeoVision LPC2011/LPC2211 1.10 web interface allows authenticated remote attackers to execute privileged operations via crafted HTTP requests. The vulnerability enables scope change (S:C) indicating potential escape from restricted web interface contexts to underlying system privileges. CVSS 9.9 (Critical) with low attack complexity and no user interaction required, making this exploitable by any authenticated user through simple web requests. No public exploit identified at time of analysis.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 Web Interface enables remote attackers to execute arbitrary JavaScript in victim browsers via crafted URLs targeting the ssi.cgi error handler. The vulnerability chains through social engineering (requires user interaction) but achieves high confidentiality impact through changed scope (S:C), allowing session hijacking and credential theft from authenticated administrators. EPSS data not provided; no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. Publicly available exploit code status unknown but detailed technical disclosure exists from Cisco Talos Intelligence.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 1.10 web interface (ssi.cgi) allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers via crafted URLs. The vulnerability achieves scope change (S:C in CVSS), enabling access to high-confidentiality data across security contexts despite requiring user interaction. No public exploit code or CISA KEV listing identified at time of analysis, though vendor advisory confirms the flaw. EPSS data not available. The RCE tag appears to be a mislabeling - this is strictly client-side JavaScript execution (XSS), not server-side remote code execution.
Authentication bypass in GeoVision LPC2011/LPC2211 license plate camera firmware version 1.10 allows remote unauthenticated attackers to brute-force predictable session cookies via the Web Interface and gain access to the device. The flaw stems from insufficient randomness in session token generation (CWE-341), enabling attackers to enumerate valid cookies through a crafted series of HTTP requests. No public exploit identified at time of analysis, and EPSS is low at 0.06%, but CISA SSVC rates technical impact as partial with no current exploitation observed.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Privilege escalation in GeoVision LPC2011/LPC2211 Web Interface allows authenticated attackers to leak stored credentials via specially crafted HTTP requests to the ssi.cgi endpoint. The vulnerability affects firmware version 1.10 and requires low-privilege user access but no additional user interaction, enabling unauthenticated credential disclosure on affected devices.
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen.
Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface.
Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis.
Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated Guest-level user to overwrite the device's administrative configuration and replace the administrator password via the SSVR service, resulting in full device takeover. The root cause is CWE-862 (Missing Authorization): the SSVR service does not enforce authorization boundaries between the Guest role and administrator-level configuration operations. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and low privilege bar make this a meaningful risk in any deployment where Guest accounts are enabled or accessible.
Privilege escalation in GeoVision LPC2011/LPC2211 1.10 web interface allows authenticated remote attackers to execute privileged operations via crafted HTTP requests. The vulnerability enables scope change (S:C) indicating potential escape from restricted web interface contexts to underlying system privileges. CVSS 9.9 (Critical) with low attack complexity and no user interaction required, making this exploitable by any authenticated user through simple web requests. No public exploit identified at time of analysis.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 Web Interface enables remote attackers to execute arbitrary JavaScript in victim browsers via crafted URLs targeting the ssi.cgi error handler. The vulnerability chains through social engineering (requires user interaction) but achieves high confidentiality impact through changed scope (S:C), allowing session hijacking and credential theft from authenticated administrators. EPSS data not provided; no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. Publicly available exploit code status unknown but detailed technical disclosure exists from Cisco Talos Intelligence.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 1.10 web interface (ssi.cgi) allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers via crafted URLs. The vulnerability achieves scope change (S:C in CVSS), enabling access to high-confidentiality data across security contexts despite requiring user interaction. No public exploit code or CISA KEV listing identified at time of analysis, though vendor advisory confirms the flaw. EPSS data not available. The RCE tag appears to be a mislabeling - this is strictly client-side JavaScript execution (XSS), not server-side remote code execution.
Authentication bypass in GeoVision LPC2011/LPC2211 license plate camera firmware version 1.10 allows remote unauthenticated attackers to brute-force predictable session cookies via the Web Interface and gain access to the device. The flaw stems from insufficient randomness in session token generation (CWE-341), enabling attackers to enumerate valid cookies through a crafted series of HTTP requests. No public exploit identified at time of analysis, and EPSS is low at 0.06%, but CISA SSVC rates technical impact as partial with no current exploitation observed.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Privilege escalation in GeoVision LPC2011/LPC2211 Web Interface allows authenticated attackers to leak stored credentials via specially crafted HTTP requests to the ssi.cgi endpoint. The vulnerability affects firmware version 1.10 and requires low-privilege user access but no additional user interaction, enabling unauthenticated credential disclosure on affected devices.