23
CVEs
2
Critical
12
High
0
KEV
0
PoC
14
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
12
MEDIUM
9
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-88278 | Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-88285 | Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward. | CRITICAL | 9.4 | 0.3% | 47 |
No patch
|
| CVE-2026-88277 | Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute arbitrary OS commands as root via the ConsumerReference.Address parameter of the ONVIF event subscription interface. The vulnerability stems from unsanitized user-controlled input passed directly to a shell interpreter on the device. Full device compromise - including credential extraction, persistent backdoor installation, and lateral movement within the physical security network - is achievable by any valid ONVIF account. No public exploit has been identified at time of analysis, and no KEV listing is present. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-88271 | Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated Guest-level user to overwrite the device's administrative configuration and replace the administrator password via the SSVR service, resulting in full device takeover. The root cause is CWE-862 (Missing Authorization): the SSVR service does not enforce authorization boundaries between the Guest role and administrator-level configuration operations. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and low privilege bar make this a meaningful risk in any deployment where Guest accounts are enabled or accessible. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-88289 | Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-88287 | Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-88286 | PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-88290 | Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-88273 | Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-88274 | OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-88275 | OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-88276 | OS command injection in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary commands with root privileges by setting a WEP key value containing embedded shell metacharacters. The root cause (CWE-78) is unsanitized passthrough of administrator-supplied WiFi configuration input into a system shell call on the embedded device OS. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-88272 | Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-88282 | Root-level command injection in GeoVision GV-LPC2211 and GV-LPC2011 license plate recognition cameras (firmware V1.13) allows an authenticated administrator to execute arbitrary OS commands as root by embedding shell metacharacters in the FTP account username field. The injected payload is executed during a subsequent FTP-account update operation, yielding complete device compromise. No public exploit is identified at time of analysis, and no confirmed patched firmware version has been independently verified. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-88288 | Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources. | MEDIUM | 6.5 | 0.4% | 33 |
No patch
|