Gv Lpc2211
by Geovision
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-88278 | Cri | 0.64 | 9.8 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations. | ||
| CVE-2026-88285 | Cri | 0.61 | 9.4 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. | ||
| CVE-2026-88277 | Hig | 0.57 | 8.8 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. | ||
| CVE-2026-88271 | Hig | 0.57 | 8.8 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. | ||
| CVE-2026-88290 | Hig | 0.49 | 7.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources. | ||
| CVE-2026-88289 | Hig | 0.49 | 7.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service. | ||
| CVE-2026-88287 | Hig | 0.49 | 7.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process. | ||
| CVE-2026-88286 | Hig | 0.49 | 7.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections. | ||
| CVE-2026-88282 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update. | ||
| CVE-2026-88276 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. | ||
| CVE-2026-88275 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied. | ||
| CVE-2026-88274 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. | ||
| CVE-2026-88273 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root. | ||
| CVE-2026-88272 | Hig | 0.47 | 7.2 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted. | ||
| CVE-2026-88288 | Med | 0.42 | 6.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service. | ||
| CVE-2026-88270 | Med | 0.42 | 6.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. | ||
| CVE-2026-88269 | Med | 0.42 | 6.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR. | ||
| CVE-2026-88268 | Med | 0.42 | 6.5 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. | ||
| CVE-2026-88284 | Med | 0.32 | 4.9 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. | ||
| CVE-2026-88283 | Med | 0.32 | 4.9 | — | Sep 10, 2026 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. |
- risk 0.64cvss 9.8epss —
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
- risk 0.61cvss 9.4epss —
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
- risk 0.57cvss 8.8epss —
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
- risk 0.57cvss 8.8epss —
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
- risk 0.49cvss 7.5epss —
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
- risk 0.49cvss 7.5epss —
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
- risk 0.49cvss 7.5epss —
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
- risk 0.49cvss 7.5epss —
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
- risk 0.47cvss 7.2epss —
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
- risk 0.42cvss 6.5epss —
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
- risk 0.42cvss 6.5epss —
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
- risk 0.42cvss 6.5epss —
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
- risk 0.42cvss 6.5epss —
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
- risk 0.32cvss 4.9epss —
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- risk 0.32cvss 4.9epss —
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Page 1 of 2