CVE-2026-57880
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile — higher than 41% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 devices running version V1.12 and earlier. The issue is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. An unauthenticated remote attacker can exploit this by sending a crafted RTSP request with overly long authentication data, leading to memory corruption, denial of service, or potentially arbitrary code execution.
Risk Assessment
The risk includes the possibility of remote code execution by an unauthenticated attacker, which could lead to full device compromise, as well as denial of service (DoS).
Recommendation
Immediately update the firmware of GeoVision GV-LPC2011 and GV-LPC2211 devices to a version newer than V1.12 if available. In the meantime, restrict access to RTSP ports (default 554) to trusted networks only.
Original NVD description (English source)
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending a crafted RTSP request containing overly long authentication data, resulting in memory corruption, denial of service, or potentially arbitrary code execution.