Geovisioninc Gv Lpc2011 Lpc2211
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Geovisioninc Gv Lpc2011 Lpc2211.
By the Year
In 2026 there have been 24 vulnerabilities in Geovisioninc Gv Lpc2011 Lpc2211 with an average score of 7.1 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 24 | 7.11 |
It may take a day or so for new Gv Lpc2011 Lpc2211 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Geovisioninc Gv Lpc2011 Lpc2211 Security Vulnerabilities
GeoVision GV-LPC2211 V1.14: Unauth VLSVR Lengths Causing Resource Exhaustion
CVE-2026-88290
7.5 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
Resource Exhaustion
VLSVR Stack Buffer Overrun in GeoVision GV-LPC2211 V1.14
CVE-2026-88289
7.5 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
Stack Overflow
GeoVision GV-LPC2211 V1.13 Unrestricted File Read via BKDownloadLink.cgi
CVE-2026-88288
6.5 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
Absolute Path Traversal
GeoVision GV-LPC2211 V1.13 ONVIF WS-Discovery Scope Token Count Overflow
CVE-2026-88287
7.5 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
Stack Overflow
GV-LPC2211 V1.13 PTZ State Flaw Blocks Accept Loop
CVE-2026-88286
7.5 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
Resource Exhaustion
GeoVision GV-LPC2211 V1.13 PTZ Control Service Exposes Remote Access Without Auth
CVE-2026-88285
9.4 - Critical
- September 10, 2026
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
Missing Authentication for Critical Function
GV-LPC2211 V1.13 Stack Overwrite via Repeated User in ONVIF SetUser
CVE-2026-88284
4.9 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Stack Overflow
GV-LPC2211 V1.13 ONVIF CreateUsers Stack Corruption
CVE-2026-88283
4.9 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Stack Overflow
GeoVision GV-LPC2211 v1.13 ONVIF DeleteUsers Array Overflow (CVE-2026-88281)
CVE-2026-88281
4.9 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
Stack Overflow
GeoVision GVLPC2211 V1.13: ONVIF SetUser password overflow crashes worker
CVE-2026-88280
4.9 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
Stack Overflow
GeoVision GVLPC2211 V1.13 ONVIF CreateUsers Stack Buffer Copy Crash
CVE-2026-88279
4.9 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
Stack Overflow
Command Injection via Admin WPA-PSK: GeoVision GV-LPC2211 V1.13
CVE-2026-88275
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
Shell injection
GeoVision GV-LPC2211 V1.13 SSID Command Injection Root
CVE-2026-88274
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
Shell injection
GeoVision GV-LPC2211 V1.13 PPPoE Username Shell Config Esc to Root
CVE-2026-88273
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
Shell injection
GeoVision GV-LPC2211 V1.13 Arbitrary Root Command via Username Metachar Exec
CVE-2026-88272
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
Shell injection
GeoVision GV-LPC2211 V1.13 Guest exploit overwrites config via SSVR
CVE-2026-88271
8.8 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
AuthZ
GV-LPC2211 V1.13 SSVR Firmware-Upgrade Mode DoS
CVE-2026-88270
6.5 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
AuthZ
GeoVision GVLPC2211 V1.13 SSVR Guest read config disclosure
CVE-2026-88269
6.5 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
AuthZ
GeoVision LPC2011/LPC2211 1.10 WebI Priv Esc via HTTP
CVE-2026-42368
9.9 - Critical
- May 04, 2026
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.
Incorrect Privilege Assignment
GeoVision LPC2011/LPC2211 1.10 Priv Esc via ssi.cgi HTTP
CVE-2026-42367
6.5 - Medium
- May 04, 2026
A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to credentials leak. An attacker can visit a webpage to trigger this vulnerability.
Insufficiently Protected Credentials
GeoVision LPC2011/LPC2211 1.10 XSS via ssi.cgi Error Message (before fixed)
CVE-2026-7371
7.4 - High
- May 04, 2026
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. Reflected XXS via the error message for requesting non-existing page.
XSS
GeoVision LPC2011/LPC2211 1.10 Reflected XSS via ssi.cgi
CVE-2026-42366
7.4 - High
- May 04, 2026
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
XSS
GeoVision LPC2011/LPC2211 1.10 Auth Bypass via Guessable Session Cookie
CVE-2026-42365
8.6 - High
- May 04, 2026
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.
Predictable from Observable State
GeoVision LPC2011/LPC2211 1.10 OS Command Injection via DdnsSetting.cgi
CVE-2026-42364
9.9 - Critical
- May 04, 2026
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.
Shell injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Geovisioninc Gv Lpc2011 Lpc2211 or by Geovisioninc? Click the Watch button to subscribe.
