A null pointer dereference flaw exists in the IEEE8021x_upload.cgi script on GeoVision GV‑LPC2011 and GV‑LPC2211 devices. An unauthenticated attacker can craft a malicious multipart HTTP request that targets certificate‑related upload fields; when parsed the CGI crashes, causing the task to terminate and the device’s authentication service to become unavailable. The vulnerability is a classic example of CWE‑476 and results in a denial of service without immediate data disclosure or privilege escalation.

The flaw affects GeoVision Inc.’s GV‑LPC2011 and GV‑LPC2211 cameras running firmware version 1.12 and earlier, as indicated by the CPE identifiers and vendor advisory. Firmware 1.13 is listed in the CPE data set, suggesting it may also be impacted.

The CVSS score of 7.5 classifies this as a high‑severity denial‑of‑service risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only a malformed HTTPS request to the CGI endpoint and no authentication, the barrier to exploitation is low. An attacker could quickly disrupt services on exposed devices, potentially affecting network availability.