CVE-2026-57873

HighCVSS 7.5

Published: 26/06/2026(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

In GeoVision GV-LPC2011 and GV-LPC2211 devices version V1.12 and earlier, an unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi. The issue is caused by improper validation of multipart upload headers when processing certificate-related fields. A remote attacker can send a malformed multipart request, causing the CGI process to crash and resulting in a denial of service.

Risk Assessment

The risk is the ability to remotely cause a service crash without authentication, potentially leading to disruptions in surveillance or access control systems.

Recommendation

It is recommended to immediately update the firmware to a version newer than V1.12 if available. If an update is not possible, restrict access to the device management interface to trusted networks only.

Other vulnerabilities in GeoVision GV-LPC2011 i GV-LPC2211 w wersji V1.12 i wcześniejszych, skrypt IEEE8021x_upload.cgi

CVE-2026-57879Critical
A stack-based buffer overflow vulnerability exists in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 devices running version V1.12 and earlier. The issue is caused by insufficient bounds checking when processing RTSP custom authentication data. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted RTSP request, potentially leading to memory corruption, denial of service, or arbitrary code execution.

Original NVD description (English source)

An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-related upload fields. A remote attacker may exploit this vulnerability by sending a malformed multipart request, causing the affected CGI process to crash and resulting in a denial of service.