CVE-2026-88278 in GV-LPC2211
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.13 represents a critical failure in the implementation of WS-Security authentication protocols within its Network Video Transmitter (NVT) or similar IP-based surveillance infrastructure. The core technical flaw lies in the absence of proper validation mechanisms for UsernameToken freshness and nonce reuse protection during ONVIF operations. In standard Web Services Security specifications, specifically those governing SOAP message integrity and confidentiality, a nonce is typically used as a unique identifier to ensure that each authentication request is distinct and time-bound. This mechanism prevents attackers from capturing valid credentials or tokens in transit and reusing them at a later time to impersonate legitimate users. The device fails to verify whether the received nonce has been previously processed or if it falls outside an acceptable temporal window, thereby rendering the cryptographic binding between the session and the specific request ineffective.
From an operational perspective, this deficiency allows for straightforward replay attacks against the ONVIF interface. An attacker with network access can intercept a valid authentication exchange using passive sniffing tools due to potential lack of transport-layer encryption or by exploiting existing sessions where tokens are transmitted in cleartext or weakly protected formats. Once captured, the PasswordDigest token and associated nonce can be injected into subsequent requests without modification. Since the device does not track used nonces nor enforce strict timestamp validation relative to server time, it accepts these replayed credentials as valid new authentication attempts. This effectively bypasses access controls, granting unauthorized entities full administrative or operational privileges over the surveillance system depending on the compromised account's permissions.
The impact of this vulnerability extends beyond simple unauthorized access. It compromises the confidentiality and integrity of video streams and device configurations. Attackers can exploit this to view live feeds without authorization, manipulate recording schedules, alter camera angles via PTZ controls, or even disable security logging features to cover their tracks. In a broader organizational context, such vulnerabilities in IoT devices often serve as entry points for lateral movement within corporate networks, potentially leading to deeper infrastructure compromise if the surveillance network is not properly segmented from critical IT assets.
This flaw aligns with CWE-294, which describes authentication bypass by capture-replay attack, and maps directly to MITRE ATT&CK technique T1078, specifically valid accounts used for initial access or persistence. The failure also reflects weaknesses in CWE-356 regarding insufficient protection against replay attacks within cryptographic protocols. To mitigate this risk, immediate firmware updates should be applied if a patch is available from GeoVision that enforces strict nonce validation and timestamp checks. In the interim, network segmentation strategies are essential to isolate ONVIF traffic on dedicated VLANs with restricted access controls. Additionally, ensuring all communication channels utilize strong TLS encryption can prevent token interception, although it does not fully mitigate replay attacks if session tokens themselves are compromised or reused improperly by the server side. Regular auditing of authentication logs for duplicate nonces and implementing rate limiting on login attempts further reduce the attack surface associated with this vulnerability.