CVE-2026-88281 in GV-LPC2011
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.13 represents a critical failure in input validation within the Network Video Transmitter (NVT) implementation of the Open Network Video Interface Forum protocol, specifically affecting user management operations. The device processes ONVIF DeleteUsers requests which contain XML payloads defining the users to be removed from the system's access control database. In this specific instance, the application fails to enforce strict limits on the number or size of Username elements included within a single request payload. This lack of boundary checking allows an authenticated administrator to construct a maliciously crafted SOAP message that exceeds the expected buffer capacity for processing user deletion operations.
From a technical perspective, the core flaw is a classic stack-based buffer overflow resulting from improper handling of untrusted input data during XML parsing and subsequent memory allocation routines. When the ONVIF worker thread processes the DeleteUsers command, it allocates a fixed-size stack array to temporarily store username strings before performing database operations. Because the application does not validate the cumulative length or count of these usernames against predefined thresholds, excessively large inputs cause the write operation to exceed the allocated stack space. This overwrites adjacent memory locations on the call stack, corrupting critical control data such as return addresses and saved frame pointers. The immediate operational consequence is a segmentation fault that causes the ONVIF worker process to terminate unexpectedly, leading to a denial of service condition where remote video streaming and management capabilities become unavailable until the device or service is restarted.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-120 Buffer Copy without Checking Size of Input, which describes situations where data is copied into a buffer without verifying that it fits within the allocated space. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates Denial of Service via resource exhaustion or crash mechanisms, categorized under tactics such as Impact and potentially Initial Access if combined with other vulnerabilities to disrupt security monitoring capabilities. The fact that authentication is required limits the attack surface to insider threats or compromised administrative credentials, yet the severity remains high due to the potential for service disruption in critical surveillance infrastructure.
Mitigation strategies should focus on implementing robust input validation mechanisms at the application layer before data reaches memory allocation functions. Developers must enforce strict length constraints and element count limits on all XML fields processed by ONVIF handlers, ensuring that no single request can exceed predefined buffer capacities. Additionally, enabling stack protection features such as Stack Canaries or Address Space Layout Randomization in the embedded firmware build process can help detect or mitigate exploitation attempts even if validation fails. For immediate remediation without code changes, administrators should restrict network access to ONVIF management interfaces using firewall rules and ensure that only trusted IP addresses have administrative privileges, thereby reducing the risk of malicious payload delivery by unauthorized actors who might gain temporary admin access through other means.