An unauthenticated stack‑based buffer overflow exists in the vlsvr component of GeoVision GV‑LPC2011 and GV‑LPC2211. The flaw results from insufficient length validation when processing remote login data, which allows an attacker to send crafted login packets that overflow the stack, corrupt memory, and potentially cause denial of service or arbitrary code execution. The vulnerability is a classic buffer overflow (CWE‑121) that could compromise confidentiality, integrity, and availability of the affected device.

The affected products are GeoVision Inc.’s GV‑LPC2011 and GV‑LPC2211, versions 1.12 and all earlier releases. These versions are deployed on Linux‑based devices that expose a remote login interface. Versions 1.13 and later are not listed as vulnerable.

The CVSS score of 9.8 indicates a critical severity. With no EPSS data available, the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote: an unauthenticated attacker can exploit the flaw by transmitting an oversized login packet to the device over the network, triggering the stack overflow and resulting in denial of service or code execution.