CVE-2026-57880 Overview
CVE-2026-57880 is an unauthenticated stack-based buffer overflow in the ssvr service of GeoVision GV-LPC2011 and GV-LPC2211 license plate capture devices running firmware V1.12 and earlier. The vulnerability stems from insufficient bounds checking when parsing Real-Time Streaming Protocol (RTSP) Digest authentication fields. A remote attacker can send a crafted RTSP request containing overly long authentication data to corrupt stack memory. Successful exploitation results in denial of service or potentially arbitrary code execution on the affected device. The flaw requires no authentication and is exploitable over the network.
Critical Impact
Remote unauthenticated attackers can trigger memory corruption in the RTSP service, leading to device crashes or arbitrary code execution on GeoVision license plate capture hardware.
Affected Products
- GeoVision GV-LPC2011 firmware V1.12 and earlier
- GeoVision GV-LPC2211 firmware V1.12 and earlier
- ssvr RTSP service component on the above devices
Discovery Timeline
- 2026-06-26 - CVE-2026-57880 published to the National Vulnerability Database
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-57880
Vulnerability Analysis
The vulnerability resides in the ssvr process, which handles RTSP traffic on GeoVision GV-LPC2011 and GV-LPC2211 devices. RTSP supports HTTP-style Digest authentication, which transmits fields such as username, realm, nonce, uri, and response inside the Authorization: Digest header. The ssvr parser copies these fields into fixed-size stack buffers without validating their length. When an attacker supplies authentication field values that exceed the destination buffer size, adjacent stack memory, including saved registers and the return address, is overwritten. This condition is classified as a stack-based buffer overflow [CWE-121]. Because the RTSP listener processes the request before authentication is verified, no valid credentials are required to reach the vulnerable code path.
Root Cause
The root cause is missing length validation on attacker-controlled tokens extracted from the RTSP Authorization: Digest header. The parser assumes bounded input and uses unsafe copy operations against fixed-size stack allocations. Any field longer than the target buffer corrupts the stack frame.
Attack Vector
Exploitation requires only network reachability to the RTSP port (typically TCP/554) exposed by the device. An attacker sends an RTSP method such as DESCRIBE or OPTIONS with a malformed Authorization: Digest header. Overlong values in fields like username="..." or nonce="..." overflow the stack buffer during parsing. Depending on the target's memory protections, the outcome ranges from process crash and denial of service to hijacked control flow and execution of attacker-supplied shellcode with the privileges of the ssvr process.
No verified public proof-of-concept is available. See the Geovision Cyber Security Overview for vendor-published technical details.
Detection Methods for CVE-2026-57880
Indicators of Compromise
- RTSP requests to affected devices containing abnormally long values in Authorization: Digest header fields such as username, realm, nonce, or response.
- Repeated crashes or restarts of the ssvr process, or the RTSP service becoming unresponsive on TCP/554.
- Outbound connections from a GeoVision device to unexpected IP addresses following inbound RTSP traffic, indicating possible post-exploitation activity.
Detection Strategies
- Deploy network intrusion detection signatures that flag RTSP Authorization headers whose token values exceed reasonable length thresholds (for example, over 256 bytes).
- Inspect RTSP traffic at the perimeter for non-printable or padding bytes inside Digest authentication fields, which are typical in overflow payloads.
- Correlate RTSP request bursts with device availability metrics to identify probing or exploitation attempts.
Monitoring Recommendations
- Log all RTSP sessions to GV-LPC2011 and GV-LPC2211 devices and centralize them for analysis.
- Alert on new or unusual source IPs initiating authenticated or unauthenticated RTSP requests to camera subnets.
- Monitor device health telemetry (CPU spikes, service restarts, watchdog reboots) as a secondary indicator of exploitation attempts.
How to Mitigate CVE-2026-57880
Immediate Actions Required
- Restrict inbound access to RTSP (TCP/554) on GV-LPC2011 and GV-LPC2211 devices to trusted management networks only.
- Remove any port-forwarding rules that expose these devices directly to the internet.
- Apply firmware updates from GeoVision as soon as they are published for the affected models.
Patch Information
GeoVision addresses firmware issues through its product security channel. Consult the Geovision Cyber Security Overview for the latest firmware versions and advisories covering GV-LPC2011 and GV-LPC2211. Devices running firmware V1.12 or earlier remain vulnerable until updated to a fixed release.
Workarounds
- Place affected devices behind a firewall or VPN and block RTSP from untrusted networks.
- Segment license plate capture devices onto an isolated VLAN with strict egress filtering.
- Where RTSP is not required by the deployment, disable the service or block TCP/554 at the network boundary.
- Enforce access control lists on network switches to permit RTSP traffic only from authorized video management servers.
# Example: block external RTSP access to GeoVision device subnet using iptables
iptables -A FORWARD -p tcp --dport 554 -d 10.20.30.0/24 -j DROP
iptables -A FORWARD -p tcp --dport 554 -s 10.10.10.0/24 -d 10.20.30.0/24 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
