GeoVision GV-LPC2011 and GV-LPC2211 Predictable from Observable State (CVE-2026-42365)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505917);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/03");

  script_cve_id("CVE-2026-42365");

  script_name(english:"GeoVision GV-LPC2011 and GV-LPC2211 Predictable from Observable State (CVE-2026-42365)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A guessable session cookie vulnerability exists in the Web Interface
functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted
series of HTTP requests can lead to an authentication bypas. An
attacker can bruteforce session cookies to trigger this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://talosintelligence.com/vulnerability_reports/");
  script_set_attribute(attribute:"see_also", value:"https://www.geovision.com.tw/cyber_security.php");
  # https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2332
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50e5881a");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42365");
  script_cwe_id(341);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/03");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-lpc2011_firmware:1.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-lpc2211_firmware:1.10");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/GeoVision");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/GeoVision');

var asset = tenable_ot::assets::get(vendor:'GeoVision');

var vuln_cpes = {
    "cpe:/o:geovision:gv-lpc2011_firmware:1.10" :
        {"versionEndIncluding" : "1.10", "versionStartIncluding" : "1.10", "family" : "GeoVisionBulletIPCameras"},
    "cpe:/o:geovision:gv-lpc2211_firmware:1.10" :
        {"versionEndIncluding" : "1.10", "versionStartIncluding" : "1.10", "family" : "GeoVisionBulletIPCameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);