286 matches found
CVE-2026-88290
GeoVision GV-LPC2211 V1.14 (260903) is affected by an unauthenticated resource-exhaustion vulnerability in its VLSVR service. Remote clients can declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, leading to exhaustion of memory, connection, and worker resources . The ...
EUVD-2026-75325
GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...
EUVD-2026-75324
GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...
CVE-2026-88289
GeoVision GV-LPC2211 V1.14 (260903) (also referenced as GV-LPC2011) is affected by multiple pre-authentication stack buffer overflows in its VLSVR request handlers . The root cause is a failure to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffer...
CVE-2026-88288
GeoVision GV-LPC2211 (also listed as GV-LPC2011) version V1.13 is affected by an arbitrary file read vulnerability in the BKDownloadLink.cgi endpoint. The root cause is a failure to restrict the filename parameter supplied to the CGI script, which allows a remote user with valid web credentials t...
EUVD-2026-75323
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...
CVE-2026-88287
GeoVision GV-LPC2211 V1.13 (also affecting GV-LPC2011 per the title) is vulnerable to a stack-frame overflow in its ONVIF WS-Discovery implementation. The root cause is a failure to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker ...
EUVD-2026-75322
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...
CVE-2026-88286
GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPC2011) contains a denial of service vulnerability in its PTZ connection-state management . An unauthenticated remote client can exploit improper handling of PTZ connection state to block the accept loop , preventing new PTZ connections and effec...
EUVD-2026-75320
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...
CVE-2026-88285
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service that requires no authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. The underlying cause is the lack of an authentication mechanism on the service itself. The CVSS v3...
EUVD-2026-75319
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands...
CVE-2026-88284
GeoVision GV-LPC2211 version 1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker, resulting in a denial of service. The vulnerability is scored CVSS 4.9 (Medium) with an attack ve...
EUVD-2026-75318
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...
EUVD-2026-75317
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...
CVE-2026-88283
GeoVision GV-LPC2211 V1.13 (and GV-LPC2011) is affected by a stack-frame overflow in the ONVIF CreateUsers service. The vulnerability is caused by a failure to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and ...
EUVD-2026-75316
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...
CVE-2026-88282
GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...
CVE-2026-88281
GeoVision GV-LPC2211 V1.13 contains a stack overflow vulnerability in its ONVIF DeleteUsers endpoint. The failure to limit repeated Username elements in a DeleteUsers request allows an authenticated administrator to overflow a stack array and crash the ONVIF worker process, resulting in a denial ...