CVE-2026-88268
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
Risk Assessment
An authenticated user can remotely crash the SSVR service, disrupting monitoring operations. Exploitation requires valid user credentials.
Recommendation
Update the GV-LPC2211 firmware to the vendor-fixed version or restrict SSVR service access to trusted networks and accounts.
Other vulnerabilities in GeoVision GV-LPC2211
See all- CVE-2026-88285Critical
The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.
- CVE-2026-88278Critical
The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.
- CVE-2026-88290High
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, enabling remote exhaustion of memory, connection, and worker resources.
- CVE-2026-88289High
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
- CVE-2026-88288Medium
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
- CVE-2026-88287High
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
- CVE-2026-88286High
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
- CVE-2026-88284Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- CVE-2026-88283Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- CVE-2026-88282High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
Original NVD description (English source)
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS