GeoVision GV-LPCLPC2011/GV-LPCLPC2211 up to 1.12 Multipart Upload IEEE8021x_upload.cgi buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in GeoVision GV-LPCLPC2011 and GV-LPCLPC2211 up to 1.12. The affected element is an unknown function of the file IEEE8021x_upload.cgi of the component Multipart Upload Handler. Such manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-57874. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GeoVision GV-LPCLPC2011 and GV-LPCLPC2211 up to 1.12. It has been rated as critical. Affected by this issue is some unknown functionality of the file IEEE8021x_upload.cgi of the component Multipart Upload Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. CVE summarizes:

An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remote attacker may exploit this vulnerability by sending a crafted upload request with overly long input, causing memory corruption and resulting in a denial of service.

The weakness was presented by Le Yu and Jincheng Wang. The advisory is available at geovision.com.tw. This vulnerability is handled as CVE-2026-57874 since 06/26/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.13 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• GeoVision

Name

• GV-LPCLPC2011
• GV-LPCLPC2211

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion