CVE-2026-88279 in GV-LPC2011
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.13 represents a classic buffer overflow condition within the device's Network Video Transport Protocol (ONVIF) implementation. Specifically, the flaw resides in how the system handles user creation requests via the CreateUsers operation. When an authenticated administrator submits a username or password field containing data that exceeds the expected length limits, the application fails to perform adequate bounds checking before copying this input into fixed-size stack-allocated memory buffers. This lack of validation allows oversized strings to overwrite adjacent memory locations on the call stack, corrupting critical control data such as return addresses and saved frame pointers.
From a technical perspective, this issue aligns with CWE-120, which describes buffer copy without checking size limits, often leading to heap or stack-based overflows depending on the specific allocation mechanism used by the firmware developer. The vulnerability is triggered during the parsing of SOAP messages sent through the ONVIF interface, where string manipulation functions like strcpy are likely employed instead of safer alternatives that enforce length constraints. Because the overflow occurs in a fixed stack field, it directly impacts the integrity of the execution context for the worker process handling the request. An attacker with valid administrative credentials can exploit this by crafting a maliciously formatted ONVIF request designed to fill and overwrite these buffers, thereby disrupting the normal flow of control within the application thread.
The operational impact of exploiting this vulnerability is primarily denial of service rather than arbitrary code execution or privilege escalation in its current manifestation. By crashing the ONVIF worker process, an authenticated administrator can effectively disable remote management capabilities via the ONVIF protocol on the device. This disruption prevents legitimate users from managing camera settings, viewing live feeds through compatible clients that rely on this interface, and performing other administrative tasks dependent on the stability of the network service component. While the immediate effect is a crash requiring a restart or reboot to restore functionality, repeated exploitation could lead to resource exhaustion if the system attempts automatic recovery without proper safeguards, potentially rendering the surveillance device unavailable for extended periods until manual intervention occurs.
Mitigation strategies should focus on both software updates and operational hardening. The most effective remediation involves applying firmware patches released by GeoVision that address this specific buffer overflow issue by implementing strict input validation and using safe string handling functions that check array bounds before copying data. In the absence of an immediate patch, administrators can mitigate risk by restricting access to the ONVIF interface through network segmentation or firewall rules, ensuring that only trusted management stations can communicate with the device on relevant ports. Additionally, enforcing strong password policies does not prevent this specific vulnerability since it is triggered by length rather than complexity, but limiting administrative account usage and monitoring for unusual spikes in failed authentication attempts may help detect potential exploitation attempts before they cause service disruption. This incident underscores the importance of rigorous input validation in embedded systems that expose network services to management interfaces, adhering to secure coding standards such as those outlined in OWASP guidelines for preventing buffer overflows.