CVE-2026-57876: GeoVision IP Camera DoS Vulnerability

CVE-2026-57876 Overview

CVE-2026-57876 is an unauthenticated out-of-bounds write vulnerability in the onvif.cgi component of GeoVision GV-LPC2011 and GV-LPC2211 license plate capture devices running firmware version V1.12 and earlier. The flaw stems from insufficient bounds checking when the CGI handler processes HTTP request body data. A remote attacker can send a crafted HTTP request containing excessive input to trigger memory corruption. Successful exploitation results in a denial-of-service condition on the affected device. The vulnerability is classified under [CWE-787] Out-of-bounds Write and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can corrupt device memory through crafted HTTP requests to onvif.cgi, causing denial of service on affected GeoVision surveillance appliances.

Affected Products

GeoVision GV-LPC2011 firmware V1.12 and earlier
GeoVision GV-LPC2211 firmware V1.12 and earlier
ONVIF service (onvif.cgi) on affected GeoVision license plate capture devices

Discovery Timeline

2026-06-26 - CVE-2026-57876 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57876

Vulnerability Analysis

The vulnerability resides in onvif.cgi, the CGI handler that processes Open Network Video Interface Forum (ONVIF) requests on GeoVision GV-LPC2011 and GV-LPC2211 devices. The handler accepts HTTP request bodies without adequately validating their length against destination buffer sizes. When an attacker submits a request whose body exceeds the expected bounds, the CGI copies data past the allocated buffer boundary, corrupting adjacent memory regions. The corruption disrupts CGI process state and terminates the ONVIF service, producing a denial-of-service outcome. The impact is limited to availability; confidentiality and integrity are not directly affected according to the published metrics.

Root Cause

The root cause is missing or insufficient length validation on attacker-controlled HTTP body data before it is written into a fixed-size buffer inside onvif.cgi. This matches the [CWE-787] Out-of-Bounds Write pattern, in which the software writes data past the end of the intended target buffer.

Attack Vector

Exploitation requires only network reachability to the device's HTTP interface. No credentials and no user interaction are needed. An attacker sends a single crafted HTTP request to the ONVIF endpoint with an oversized body, triggering the out-of-bounds write and crashing the service. Devices exposed to the internet or untrusted networks are directly reachable from an attacker's host.

No verified proof-of-concept code has been published for CVE-2026-57876. Refer to the GeoVision Cyber Security Resource for authoritative technical details.

Detection Methods for CVE-2026-57876

Indicators of Compromise

Unexpected termination or repeated restarts of the onvif.cgi process on GV-LPC2011 or GV-LPC2211 devices
HTTP POST or GET requests to ONVIF endpoints containing abnormally large request bodies from a single source
Loss of ONVIF service availability while other device functions remain partially operational

Detection Strategies

Inspect HTTP traffic destined for GeoVision devices for requests targeting onvif.cgi with Content-Length values that exceed typical ONVIF payload sizes
Correlate device availability drops with inbound HTTP requests to the ONVIF service using network flow logs
Deploy IDS/IPS signatures that flag oversized SOAP or XML bodies sent to ONVIF endpoints on port 80/443

Monitoring Recommendations

Forward device syslog and HTTP access logs to a centralized SIEM to alert on repeated CGI crashes or restarts
Monitor ICMP and TCP reachability of camera management interfaces to detect service outages promptly
Alert on inbound connections to GeoVision management interfaces originating from outside authorized management subnets

How to Mitigate CVE-2026-57876

Immediate Actions Required

Restrict network access to the management and ONVIF interfaces of GV-LPC2011 and GV-LPC2211 devices to trusted VLANs or management jump hosts only
Remove any direct internet exposure of the device HTTP/HTTPS ports and place devices behind a firewall or VPN
Inventory all GeoVision GV-LPC2011 and GV-LPC2211 units and identify those running firmware V1.12 or earlier

Patch Information

GeoVision publishes firmware updates and advisories through its GeoVision Cyber Security Resource. Administrators should consult the vendor page for the fixed firmware version addressing CVE-2026-57876 and apply the update to all affected GV-LPC2011 and GV-LPC2211 devices. Validate firmware integrity after upgrade and confirm the ONVIF service resumes normal operation.

Workarounds

Block external access to onvif.cgi at the perimeter firewall or upstream reverse proxy until firmware is updated
Enforce source-IP allowlists on the device or upstream gateway so only authorized video management systems can reach the ONVIF endpoint
Rate-limit HTTP requests to the device and drop requests with Content-Length values exceeding expected ONVIF payload sizes

bash

# Example iptables rules restricting ONVIF access to a trusted management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -d <device_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -d <device_ip> -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -d <device_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <device_ip> -j DROP