Description
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Published: 2026-09-10
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to send multiple User elements in an ONVIF CreateUsers request without proper limits, which can overwrite stack control state and crash the ONVIF worker. The resulting stack-frame overflow leads to a denial of service for the affected device. The weakness corresponds to CWE-121, a stack-based buffer overwrite.

Affected Systems

GeoVision Inc. GV-LPC2011/LPC2211, version 1.13. The product is also identified in the Common Platform Enumeration list for versions 1.13 and 1.14, but only version 1.13 is explicitly affected by the described vulnerability.

Risk and Exploitability

The CVSS base score of 4.9 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The vulnerability requires authenticated administrator privileges, so attack requires legitimate or compromised credentials. If an attacker gains such access, the stack overflow can be triggered, leading to an application crash and loss of availability.

Generated by OpenCVE AI on September 10, 2026 at 09:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest firmware or software patch for GV-LPC2011/LPC2211 that addresses the stack overflow in the CreateUsers request.
  • Restrict access to the ONVIF service so that only trusted administrators can send CreateUsers requests; consider disabling the CreateUsers endpoint if it is not required.
  • After patching or reconfiguration, monitor device logs for crash events to confirm the mitigation has been effective.

Generated by OpenCVE AI on September 10, 2026 at 09:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Title GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service
First Time appeared Geovision Inc.
Geovision Inc. gv-lpc2011 Lpc2211
Weaknesses CWE-121
CPEs cpe:2.3:a:geovision_inc.:gv-lpc2011_lpc2211:1.13:*:*:*:*:*:*:*
cpe:2.3:a:geovision_inc.:gv-lpc2011_lpc2211:1.14:*:*:*:*:*:*:*
Vendors & Products Geovision Inc.
Geovision Inc. gv-lpc2011 Lpc2211
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Geovision Inc. Gv-lpc2011 Lpc2211
cve-icon MITRE

Status: PUBLISHED

Assigner: GV

Published:

Updated: 2026-09-10T15:11:03.404Z

Reserved: 2026-09-10T02:56:04.082Z

Link: CVE-2026-88283

cve-icon Vulnrichment

Updated: 2026-09-10T15:10:58.748Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T09:17:05.337

Modified: 2026-09-10T16:18:10.067

Link: CVE-2026-88283

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T19:45:17Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow