CVE-2026-88290 in GV-LPC2011
Summary
by MITRE • 09/10/2026
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in GeoVision GV-LPC2211 firmware version 1.14 (build date 260903) represents a critical resource management failure within the device's network communication stack. Specifically, the flaw resides in how the VLSVR service handles incoming frame length declarations from unauthenticated clients. The system fails to enforce strict upper bounds on these declared lengths, allowing an attacker to specify arbitrarily large values for frame sizes. This lack of input validation and boundary checking creates a direct pathway for resource exhaustion attacks against the target device.
From a technical perspective, this vulnerability is classified under CWE-400: Uncontrolled Resource Consumption. The core issue involves the application's inability to properly validate or limit the size of data structures allocated in response to client requests. When an unauthenticated user sends a request with an excessively large VLSVR frame length declaration, the server attempts to allocate memory and establish resources corresponding to that magnitude. Because there is no mechanism to reject such oversized declarations before resource allocation occurs, the system becomes vulnerable to denial-of-service conditions through simple network-based exploitation techniques.
The operational impact of this flaw is severe for any deployment relying on continuous availability of video surveillance or management infrastructure. By repeatedly sending requests with unbounded frame lengths, an attacker can trigger indefinite delays in blocking receive operations within the server's worker threads. This behavior effectively ties up system resources without requiring authentication credentials. The consequence is a progressive exhaustion of available memory, network connections, and processing workers on the device. As these resources are consumed, legitimate users experience degraded performance or complete service unavailability, rendering the surveillance equipment non-functional during critical periods.
This attack vector aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically sub-technique T1498.002 which involves resource exhaustion through application layer attacks. The absence of authentication requirements for this specific endpoint significantly lowers the barrier to entry for attackers, allowing anyone on the network segment with access to the device's IP address and port to execute the attack. This makes it particularly dangerous in environments where devices are exposed to untrusted networks or lack proper segmentation controls.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is for GeoVision to release a firmware update that implements strict input validation, ensuring that VLSVR frame lengths do not exceed predefined maximum limits before any memory allocation takes place. In the interim, network administrators should restrict access to the affected service using firewall rules or Access Control Lists (ACLs) to allow only trusted management stations to communicate with the device on the relevant ports. Additionally, implementing rate limiting and connection timeouts at the network perimeter can help mitigate the impact of such attacks by preventing a single source from monopolizing resources through rapid-fire requests. Regular monitoring for unusual spikes in resource usage or connection counts can also aid in early detection of exploitation attempts.