GeoVision GV-LPC2011 and GV-LPC2211 firmware versions 1.13 and 1.14 fail to restrict repeated User elements in ONVIF SetUser requests. An authenticated administrator can exploit this by sending a crafted request that overwrites stack control state, causing the ONVIF worker process to crash. The result is a denial of service that disables the ONVIF interface, disrupting remote management and monitoring capabilities.

The vulnerability affects GeoVision Inc’s GV-LPC2011 and GV-LPC2211 models, specifically firmware releases 1.13 and 1.14. These variants are used in various security camera and network video recorder deployments worldwide.

The CVSS score of 4.9 indicates a moderate severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. The vulnerability requires authenticated administrator access to construct the malicious SetUser request, so the attack surface is constrained to users who have local or network privileges on the device. An attacker could bring the affected ONVIF worker offline, leading to service interruption, but no information disclosure or code execution is reported.