The vulnerability allows an attacker to guess session cookies used by the web interface of GeoVision LPC2011/LPC2211 devices. By sending a sequence of crafted HTTP requests, an attacker can brute‑force valid session identifiers and bypass authentication, gaining unrestricted access to the device’s management functionality without any prior credentials. This flaw is a session‑management weakness (CWE‑341) and, if exploited, can lead to complete compromise of the device.

Affected systems are GeoVision Inc.’s GV‑LPC2011/LPC2211 firmware version 1.10 and earlier. The vendor has released a patched firmware version V1.12‑260330 that addresses the issue.

The CVSS score of 8.6 classifies this vulnerability as critical. The EPSS score is currently unavailable, but the absence of a KEV listing does not diminish the risk. Exploitation requires remote access to the device’s web interface and the ability to send HTTP requests, meaning that remote attackers can easily reach the target from the Internet. Because the flaw permits authentication bypass, the potential impact is full compromise, data theft, and service disruption.