GV-LPCLPC2011/2211 vulnerabilities
13 known vulnerabilities in GV-LPCLPC2011/2211 from GeoVision. 13 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
GV-LPCLPC2011/2211: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
- 9.8 Critical severity
GV-LPCLPC2011/2211: Authentication Bypass by Capture-replay
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
- 8.8 High severity
GV-LPCLPC2011/2211: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
- 9.8 Critical severity
GV-LPCLPC2011/2211: Stack-based Buffer Overflow
An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploi
- 9.8 Critical severity
GV-LPCLPC2011/2211: Stack-based Buffer Overflow
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker
- 9.8 Critical severity
GV-LPCLPC2011/2211: Stack-based Buffer Overflow
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker
- 9.8 Critical severity
GV-LPCLPC2011/2211: Stack-based Buffer Overflow
An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request pat
- 8.6 High severity
GV-LPCLPC2011/2211: Use of Externally-Controlled Format String
An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path.
- 7.5 High severity
GV-LPCLPC2011/2211: Out-of-bounds Write
An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit
- 7.5 High severity
GV-LPCLPC2011/2211: NULL Pointer Dereference
An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of required HTTP request
- 7.5 High severity
GV-LPCLPC2011/2211: Buffer Copy without Checking Size of Input
An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remot
- 7.5 High severity
GV-LPCLPC2011/2211: NULL Pointer Dereference
An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-relate
- 7.5 High severity
GV-LPCLPC2011/2211: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient validation of user-supplied file path input before the requested file is accessed