The vulnerability is a stack‑based buffer overflow located in the ssvr component of GeoVision GV‑LPC2011 and GV‑LPC2211 firmware versions 1.12 and earlier. It arises from insufficient bounds checking while parsing the RTSP Digest authentication fields. A remote attacker can send a specially crafted RTSP request containing excessively long authentication data, causing memory corruption that can lead to a denial of service or, in the worst case, arbitrary code execution on the device. The CVSS score of 9.8 reflects the critical severity of the issue.

Affected devices are GeoVision Inc.’s GV‑LPC2011 and GV‑LPC2211 cameras running firmware 1.12 or earlier. Firmware 1.13 and newer versions contain the fix and are not impacted.

The CVSS score of 9.8 indicates high risk, and the vulnerability can be exploited from any external network location that can reach the RTSP service. No authentication is required to trigger the overflow. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker who successfully exploits the buffer overflow could achieve remote code execution, leading to full system compromise. The lack of access restrictions means that any host with network visibility to the RTSP endpoint is a potential target.