A vulnerability exists in GeoVision GV-LPC2011 and GV-LPC2211 version 1.12 and earlier that allows an unauthenticated attacker to trigger a null pointer dereference during HTTP request parsing. The flaw occurs because required HTTP request metadata is not validated before being used by the CGI components. Exploitation results in the affected process crashing, which leads to a denial of service and potential service interruption. This weakness is identified as CWE‑476, which describes improper validation of a null pointer reference.

The affected systems are the GeoVision Inc. GV-LPC2011 and GV-LPC2211 CCTV and monitoring devices running firmware version 1.12 or earlier. The product is distributed under the brand GeoVision. It is unknown whether versions beyond 1.12 contain a fix; specific remediation details are not listed in the advisory.

The CVSS score of 7.5 indicates high severity, while the EPSS score is 1% and the vulnerability is not listed in the current CISA KEV catalog. The attack vector is remote, requiring only that the attacker sends a specially crafted HTTP request to the CGI component. The lack of authentication preconditions and the possibility of causing an immediate crash make this a straightforward denial of service attack once reachable.