An unauthenticated buffer overflow exists in the IEEE8021x_upload.cgi component of GeoVision’s GV-LPC2011 and GV-LPC2211 cameras. The flaw arises from insufficient bounds checking of filename values in multipart upload data, allowing an attacker to send a crafted upload request with an overly long filename. This overflow corrupts memory and can crash the device, resulting in a denial of service. The associated CVSS score of 7.5 indicates a high severity of the vulnerability.

The affected products are GeoVision’s GV-LPC2011 and GV-LPC2211 devices running on Linux. Vulnerable firmware releases include version 1.12 and earlier, as specified in the vulnerability description. The Common Platform Enumeration strings also reference release 1.13, but the description specifically notes 1.12 and earlier are impacted.

The vulnerability carries a CVSS score of 7.5, with no EPSS data available, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be a network‑based, unauthenticated request to the device’s HTTP interface, specifically targeting the IEEE8021x_upload.cgi endpoint. An attacker simply needs the ability to upload a file through this CGI; no authentication is required, and by supplying a filename that exceeds expected bounds, the attacker can trigger a memory corruption that typically results in a device reboot or crash, thereby denying service to legitimate users.