CVE-2026-88280 in GV-LPC2011
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.13 represents a classic buffer overflow condition within the device's Network Video Transport Web Service (ONVIF) implementation. Specifically, the flaw resides in how the system handles password updates for user accounts via the SetUser operation. When an authenticated administrator submits a request to modify a user's credentials, the application fails to validate the length of the provided password string against the size of the destination buffer allocated on the stack. This lack of bounds checking allows an oversized input value to be copied directly into a fixed-size memory location without truncation or error handling for excessive data lengths.
From a technical perspective, this is a Stack-based Buffer Overflow vulnerability that aligns with Common Weakness Enumeration (CWE) category CWE-120: Buffer Copy without Checking Size of Input. The ONVIF protocol relies on SOAP messages transmitted over HTTP to manage device configurations and media streams. In this specific instance, the SetUser method processes incoming XML data containing user credentials. If the password field exceeds the expected maximum length defined by the firmware's internal logic, the excess bytes overwrite adjacent memory locations on the stack. This corruption of the stack frame can lead to the overwriting of critical control data such as return addresses or saved base pointers, which fundamentally destabilizes the execution flow of the ONVIF worker process responsible for handling these requests.
The operational impact of this vulnerability is primarily characterized by a denial of service rather than immediate remote code execution in its default state. Because the flaw allows an authenticated administrator to crash the ONVIF worker, it effectively disrupts the device's ability to handle network video transport protocols. This disruption can cause the entire surveillance system to become unresponsive or require a manual reboot to restore functionality. While buffer overflows are often associated with privilege escalation and arbitrary code execution, in this specific embedded context, the immediate consequence is service interruption. An attacker who has obtained administrative credentials could exploit this flaw repeatedly to maintain a persistent denial of service condition against the video management infrastructure, thereby compromising the availability aspect of the CIA triad for security operations relying on continuous monitoring.
This vulnerability maps to MITRE ATT&CK technique T1499: Endpoint Denial of Service under the Impact tactic. The exploitation requires authentication, which places it within the scope of insider threats or compromised administrative accounts rather than unauthenticated remote attacks. However, given that ONVIF is a widely adopted standard for interoperability among IP-based physical security products, any instability in this protocol can have cascading effects on integrated video management systems and recording servers that depend on stable connections to these endpoints.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary solution is to apply the firmware update provided by GeoVision that addresses this specific buffer handling issue, ensuring that input validation routines are correctly implemented for all ONVIF SetUser operations. Administrators should also enforce strict password complexity policies that limit maximum length if possible, although software-level fixes remain essential as client-side restrictions can be bypassed. Furthermore, network segmentation strategies can help isolate critical surveillance infrastructure from broader corporate networks to limit the blast radius of any potential exploitation. Regular auditing of administrative access and monitoring for unusual patterns in ONVIF traffic may also aid in early detection of such abuse attempts before they result in service disruption.