CVE-2026-57881
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile — higher than 29% of all known CVEs
Summary
In GeoVision GV-LPC2011 and GV-LPC2211 devices version V1.12 and earlier, a stack-based buffer overflow vulnerability exists in the vlsvr component. An unauthenticated remote attacker can exploit this vulnerability by sending crafted login data with overly long input, leading to memory corruption, denial of service, or potentially remote code execution.
Risk Assessment
The risk for the organization includes the possibility of remote takeover of the device, which may lead to compromise of the monitoring system integrity, data leakage, or service disruption.
Recommendation
It is recommended to immediately update the firmware to a version newer than V1.12 if available, and restrict access to the device management interface to trusted networks only.
Original NVD description (English source)
An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploit this vulnerability by sending crafted login data with overly long input, resulting in memory corruption, denial of service, or potentially arbitrary code execution.