CVE-2026-57875: GeoVision IP Camera DoS Vulnerability

CVE-2026-57875 Overview

CVE-2026-57875 is an unauthenticated NULL pointer dereference vulnerability in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LPC2211 license plate capture devices running firmware V1.12 and earlier. The flaw stems from improper validation of required HTTP request metadata before that data is consumed by affected CGI handlers. A remote attacker can send a specially crafted HTTP request to crash the affected process and trigger a denial of service. The weakness is tracked as [CWE-476].

Critical Impact
An unauthenticated remote attacker can crash CGI services on affected GeoVision devices with a single malformed HTTP request, disrupting license plate capture operations.

Affected Products

GeoVision GV-LPC2011 firmware V1.12 and earlier
GeoVision GV-LPC2211 firmware V1.12 and earlier
CGI components handling HTTP request parsing on the above devices

Discovery Timeline

2026-06-26 - CVE-2026-57875 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57875

Vulnerability Analysis

The vulnerability resides in HTTP request parsing routines shared by multiple CGI components on GeoVision GV-LPC2011 and GV-LPC2211 devices. Affected handlers reference pointers derived from HTTP request metadata such as headers, query parameters, or content descriptors without confirming that those fields were supplied. When the expected metadata is absent, the pointer resolves to NULL and the subsequent dereference crashes the CGI process.

Because the CGI endpoints are exposed over the network and do not require authentication, the attacker only needs reachability to the device's HTTP interface. Successful exploitation halts the affected service and interrupts license plate capture, streaming, or administration functionality until the process or device restarts. The issue does not expose data or grant code execution, but it undermines availability of surveillance infrastructure.

EPSS currently estimates a 1.266% probability of exploitation activity, placing the CVE in the 66th percentile relative to other published vulnerabilities.

Root Cause

The CGI components dereference pointers obtained from HTTP request metadata before validating that the metadata was present in the request. Missing null checks on inputs that upstream code treats as mandatory lead directly to the NULL pointer dereference described in [CWE-476].

Attack Vector

Exploitation occurs entirely over the network with low attack complexity and no privileges. An attacker sends a crafted HTTP request that omits or malforms the required metadata to one of the vulnerable CGI endpoints. The request causes the handler to dereference a NULL pointer and terminate. Repeated requests maintain the denial-of-service condition against the device.

No verified public exploit code is available at the time of publication. Technical details are described in the GeoVision Cyber Security Information advisory.

Detection Methods for CVE-2026-57875

Indicators of Compromise

Unexpected termination or restart of CGI worker processes on GV-LPC2011 or GV-LPC2211 devices
HTTP 5xx responses or connection resets returned by CGI endpoints immediately after receiving external requests
Gaps in license plate capture logs correlated with inbound HTTP traffic from untrusted sources

Detection Strategies

Inspect device logs for repeated CGI process crashes or watchdog-triggered restarts following inbound HTTP requests
Alert on HTTP requests to GeoVision CGI paths that omit required headers, parameters, or content fields
Correlate network telemetry showing external sources probing device HTTP interfaces with subsequent service outages

Monitoring Recommendations

Forward device syslog and HTTP access logs to a central log platform for continuous review
Monitor availability of the GeoVision HTTP service with active health checks and alert on repeated failures
Track NetFlow or firewall logs for HTTP sessions to camera subnets originating outside expected management ranges

How to Mitigate CVE-2026-57875

Immediate Actions Required

Restrict network access to the HTTP interface of GV-LPC2011 and GV-LPC2211 devices to trusted management networks only
Place affected cameras behind a firewall or VPN and block direct exposure to the internet
Review the GeoVision Cyber Security Information advisory and apply firmware updates when released by the vendor

Patch Information

GeoVision publishes firmware and security notices through its Cyber Security Information page. Administrators should verify installed firmware against the latest release for GV-LPC2011 and GV-LPC2211 and upgrade any device running V1.12 or earlier once a fixed version is available.

Workarounds

Enforce IP allow-listing on device HTTP endpoints so only authorized management hosts can reach CGI components
Terminate inbound HTTP traffic at an upstream reverse proxy or WAF that drops requests missing required headers or parameters
Rate-limit and geo-restrict access to camera management interfaces to reduce exposure to opportunistic scanning

bash

# Example iptables restriction limiting CGI HTTP access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP