Geovisioninc Gv Lpclpc2011 2211
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Geovisioninc Gv Lpclpc2011 2211.
By the Year
In 2026 there have been 15 vulnerabilities in Geovisioninc Gv Lpclpc2011 2211 with an average score of 8.3 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 15 | 8.32 |
It may take a day or so for new Gv Lpclpc2011 2211 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Geovisioninc Gv Lpclpc2011 2211 Security Vulnerabilities
GeoVision GV-LPC2211 V1.13 FTP Username Shell Metachar Exec Root
CVE-2026-88282
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
Shell injection
GeoVision GV-LPC2211 V1.13 WS-Security UsernameToken Replay
CVE-2026-88278
9.8 - Critical
- September 10, 2026
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
Authentication Bypass by Capture-replay
GV-LPC2211 V1.13 Root Exploit via ONVIF ConsumerReference.Address
CVE-2026-88277
8.8 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
Shell injection
GeoVision GV-LPC2211 V1.13 Admin WEP key shell exec root
CVE-2026-88276
7.2 - High
- September 10, 2026
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
Shell injection
GeoVision GV-LPC2211 V1.13 Authenticated SSVR Stack Buffer Overflow
CVE-2026-88268
6.5 - Medium
- September 10, 2026
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
Stack Overflow
Stack buffer overflow in vlsvr GV-LPC2011/2211 V1.12 and earlier
CVE-2026-57881
9.8 - Critical
- June 26, 2026
An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploit this vulnerability by sending crafted login data with overly long input, resulting in memory corruption, denial of service, or potentially arbitrary code execution.
Stack Overflow
Stack-based Buffer Overflow in ssvr (GeoVision GV-LPC2011/2211) v1.12- via RTSP Auth
CVE-2026-57880
9.8 - Critical
- June 26, 2026
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending a crafted RTSP request containing overly long authentication data, resulting in memory corruption, denial of service, or potentially arbitrary code execution.
Stack Overflow
GeoVision GV-LPC2011 ssvr stack overflow before V1.12
CVE-2026-57879
9.8 - Critical
- June 26, 2026
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker may exploit this vulnerability by sending a crafted RTSP request, resulting in memory corruption, denial of service, or potentially arbitrary code execution.
Stack Overflow
GeoVision GV-LPC thttpd stack overflow before 1.12
CVE-2026-57878
9.8 - Critical
- June 26, 2026
An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request path. A remote attacker may exploit this vulnerability by sending a crafted HTTP request with overly long input, resulting in memory corruption, denial of service, or potentially arbitrary code execution.
Stack Overflow
GeoVision GVLPC2011/2211 vlsvr format string (V1.12 and earlier)
CVE-2026-57877
8.6 - High
- June 26, 2026
An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this vulnerability by sending crafted login data, potentially causing information disclosure, memory corruption, or a denial of service.
Use of Externally-Controlled Format String
GVLPC2011/2211 v1.12earlier: OOB Write via onvif.cgi
CVE-2026-57876
7.5 - High
- June 26, 2026
An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit this vulnerability by sending a crafted request with excessive input, causing memory corruption and resulting in a denial of service.
Memory Corruption
Geovision GV-LPC NPE in HTTP Parsing (1.12)
CVE-2026-57875
7.5 - High
- June 26, 2026
An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of required HTTP request metadata before it is used by the affected components. A remote attacker may exploit this vulnerability by sending a specially crafted HTTP request, causing the affected process to crash and resulting in a denial of service.
NULL Pointer Dereference
GeoVision GV-LPC v1.12- IEEE8021x_upload.cgi Buffer Overflow
CVE-2026-57874
7.5 - High
- June 26, 2026
An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remote attacker may exploit this vulnerability by sending a crafted upload request with overly long input, causing memory corruption and resulting in a denial of service.
Classic Buffer Overflow
GeoVision GV-LPC2011/2211 V1.12- pre v1.12 NULL ptr deref in IEEE8021x_upload.cgi
CVE-2026-57873
7.5 - High
- June 26, 2026
An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-related upload fields. A remote attacker may exploit this vulnerability by sending a malformed multipart request, causing the affected CGI process to crash and resulting in a denial of service.
NULL Pointer Dereference
CVE-2026-57872: DIR TRAV in get_fcont.cgi (GVLPC2011/2211 <=1.12)
CVE-2026-57872
7.5 - High
- June 26, 2026
An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient validation of user-supplied file path input before the requested file is accessed by the CGI component. A remote attacker may exploit this vulnerability by sending a crafted request to read arbitrary files accessible to the affected process, resulting in information disclosure.
Directory traversal
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Geovisioninc Gv Lpclpc2011 2211 or by Geovisioninc? Click the Watch button to subscribe.
