GeoVision's GV‑LPC2011/LPC2211 firmware versions 1.13 and 1.14 are vulnerable to a stack‑frame overflow when an authenticated administrator submits an ONVIF CreateUsers request with an oversized username or password. The kernel copies the input string into a fixed size stack buffer, causing the ONVIF worker process to crash. The resulting denial of service can render the device unavailable until a reboot occurs. The flaw is a classic buffer overflow, classified as CWE‑121.

The vulnerability affects GeoVision Inc. devices running GV‑LPC2011 or GV‑LPC2211 firmware version 1.13 and, as indicated by the CPE list, 1.14 as well. A successful exploit requires the attacker to have authenticated administrator privileges or to be able to send privileged ONVIF CreateUsers requests to the target device.

The CVSS base score of 4.9 indicates moderate severity. Exploit probability is unknown as the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires valid administrator credentials or a channel to send ONVIF CreateUsers requests, implying that the attacker must have some level of remote or local access to the device.