GV-LPC2011/LPC2211 vulnerabilities
11 known vulnerabilities in GV-LPC2011/LPC2211 from GeoVision. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
GV-LPC2011/LPC2211: Uncontrolled Resource Consumption
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
- 7.5 High severity
GV-LPC2011/LPC2211: Stack-based Buffer Overflow
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
- 7.5 High severity
GV-LPC2011/LPC2211: Stack-based Buffer Overflow
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
- 7.5 High severity
GV-LPC2011/LPC2211: Uncontrolled Resource Consumption
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
- 9.4 Critical severity
GV-LPC2011/LPC2211: Missing Authentication for Critical Functionality
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
- 7.2 High severity
GV-LPC2011/LPC2211: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
- 7.2 High severity
GV-LPC2011/LPC2211: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
- 7.2 High severity
GV-LPC2011/LPC2211: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
- 9.9 Critical severity
GV-LPC2011/LPC2211: Incorrect Privilege Assignment
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.
- 7.5 High severity
GV-LPC2011/LPC2211: Predictable from Observable State
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vu
- 8.8 High severity
GV-LPC2011/LPC2211: Improper Neutralization of Special Elements used in an OS Command
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vu