CVE-2026-88288 in GV-LPC2011
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.13 represents a critical security flaw within the device's web management interface, specifically affecting the BKDownloadLink.cgi script. This component is designed to facilitate file downloads for users who have authenticated with valid credentials. However, the implementation fails to adequately sanitize or validate the filename parameter provided by the client during HTTP requests. This lack of input validation allows an attacker to manipulate the path traversal logic inherent in how the server processes the requested resource name. By injecting directory traversal sequences such as dot-dot-slash into the filename argument, a remote user can bypass intended access controls and direct the web service to retrieve files from arbitrary locations on the underlying operating system file hierarchy rather than restricting retrieval to designated public directories.
From a technical perspective, this flaw is classified under CWE-22 Improper Limitation of a Pathname to a Restricted Directory. The root cause lies in the insufficient filtering of user-supplied input before it is passed to system-level file access functions. Because the web service operates with elevated privileges, likely running as or equivalent to the root user on the embedded Linux device, any file read operation initiated through this vector inherits those high-level permissions. Consequently, an attacker does not need to exploit a separate privilege escalation vulnerability; they can directly leverage the existing administrative credentials of the web interface to access sensitive system files that are normally protected from standard users or unauthenticated visitors.
The operational impact of this vulnerability is severe due to the nature of Internet of Things devices like network video recorders and surveillance systems. These devices often store configuration data, cryptographic keys, database dumps containing user hashes, and potentially other proprietary firmware components in accessible directories if path traversal succeeds. An attacker with valid web credentials can extract these files locally for offline analysis. This could lead to the compromise of authentication mechanisms through hash cracking, the exposure of network topology details, or the theft of sensitive surveillance data stored on the device's internal storage. Furthermore, access to system configuration files might reveal default passwords or hardcoded secrets that are not properly rotated, facilitating further lateral movement within a protected network segment where such devices are typically deployed.
This vulnerability aligns with MITRE ATT&CK technique T1083 File and Directory Discovery, as the attacker uses the flaw to enumerate and access restricted system resources. It also reflects aspects of CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The attack requires valid credentials, which places it in a context where insider threats or compromised accounts are primary vectors for exploitation. While this is not a remote code execution vulnerability per se, the ability to read arbitrary files significantly degrades the confidentiality and integrity guarantees provided by the device's security model. It undermines trust in the administrative interface and can serve as an initial foothold for more complex attacks if combined with other weaknesses such as weak password policies or unpatched backend services.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The most effective solution is to apply any available firmware updates from GeoVision that address this input validation issue, ensuring the BKDownloadLink.cgi script properly canonicalizes file paths and restricts access to a predefined whitelist of directories or files. In cases where patching is not immediately possible, network-level controls such as firewall rules can be implemented to limit access to the web management interface only from trusted administrative subnets, reducing the attack surface for credential-based attacks. Additionally, enforcing strong password policies and multi-factor authentication reduces the likelihood that an attacker obtains valid credentials in the first place. Regular security audits of embedded device configurations should include checks for path traversal vulnerabilities in all CGI scripts exposed via HTTP interfaces to prevent similar issues from persisting or emerging in future firmware versions.