PT-2026-89316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied...

PT-2026-89328

🚨 HIGH SEVERITY: CVE-2026-88287 CVSS 7.5 GeoVision GV-LPC2211 V1.13 vulnerable to unauthenticated remote DoS via ONVIF WS-Discovery exploit. Stack corruption possible. Affected orgs: patch immediately. CVE Vulnerability PatchNow ThreatIntel https://t.co/3PnGa2XGRC...

CVE-2026-88274: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root...

PT-2026-89309

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service...

CVE-2026-88288: Absolute Path Traversal

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

PT-2026-89329

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

PT-2026-89321

GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...

PT-2026-89317

🚨 HIGH SEVERITY: CVE-2026-88276 CVSS 7.2 GeoVision GV-LPC2211 V1.13 vulnerable to command injection via WEP key values. Allows arbitrary code execution as root. Admins: Review device configs immediately. CVE Vulnerability PatchNow https://t.co/I9snAGnoKZ...

PT-2026-89319

🚨 CRITICAL: CVE-2026-88278 CVSS 9.8 GeoVision GV-LPC2211 V1.13 vulnerable to WS-Security token replay attacks. Captured credentials can be reused for unauthorized ONVIF operations. Patch immediately if deployed. CVE Vulnerability PatchNow ThreatIntel https://t.co/WFrJmEw0KA...

CVE-2026-88290: Uncontrolled Resource Consumption

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

PT-2026-89313

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

CVE-2026-88283: Stack-based Buffer Overflow

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...

CVE-2026-88276: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root...

PT-2026-89325

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...

CVE-2026-88289: Stack-based Buffer Overflow

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

CVE-2026-88287: Stack-based Buffer Overflow

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...

PT-2026-89311

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

CVE-2026-88269: Missing Authorization

GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR...

PT-2026-89331

🚨 HIGH: CVE-2026-88290 CVSS 7.5 GeoVision GV-LPC2211 V1.14 vulnerable to unauthenticated resource exhaustion via unbounded VLSVR frame lengths. Remote attackers can exhaust memory & connections. Patch immediately. CVE Vulnerability https://t.co/a8839UViqf...

CVE-2026-88273: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...