An unauthenticated directory traversal vulnerability exists in the get_fcont.cgi component of GeoVision GV-LPC2011 and GV-LPC2211. The flaw arises because the CGI script does not properly validate the user-supplied file path before accessing the requested file, allowing an attacker to read arbitrary files that the web process can access. This exploitable weakness can expose sensitive configuration data, credentials, or other confidential files, constituting a confidentiality breach. The weakness aligns with CWE‑22, Directory Traversal.

The vulnerability affects GeoVision Inc.’s GV-LPC2011 and GV-LPC2211 devices running firmware version 1.12 or older on Linux operating systems. No newer firmware versions are listed as affected.

The CVSS score of 7.5 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote, as a malicious actor can issue a crafted HTTP request to the vulnerable CGI endpoint to obtain arbitrary file contents. Because authentication is not required, any host reachable via the web interface is at risk, especially if exposed to the public Internet.