CVE-2026-88278 Overview
CVE-2026-88278 affects the GeoVision GV-LPC2211 license plate capture camera running firmware version V1.13. The device fails to enforce WS-Security UsernameToken freshness checks or nonce reuse protection on its ONVIF interface. An attacker who captures a valid PasswordDigest token can replay it to authenticate subsequent ONVIF operations. The weakness is classified under CWE-294: Authentication Bypass by Capture-replay.
Critical Impact
Network-adjacent attackers can replay captured authentication tokens to invoke ONVIF operations, gaining full control over affected cameras without credential knowledge.
Affected Products
- GeoVision GV-LPC2211 firmware version V1.13
- ONVIF service endpoints on the affected device
- Deployments exposing GeoVision ONVIF traffic on untrusted networks
Discovery Timeline
- 2026-09-10 - CVE-2026-88278 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-88278
Vulnerability Analysis
The GV-LPC2211 exposes an ONVIF interface that authenticates callers using the WS-Security UsernameToken profile. This profile requires the client to submit a PasswordDigest computed from the password, a random Nonce, and a Created timestamp. Servers must reject stale timestamps and previously seen nonces to prevent replay.
The affected firmware performs neither check. Once an attacker captures a valid SOAP request containing a PasswordDigest, they can resubmit that exact header to invoke any ONVIF operation the original user was authorized to perform. Because ONVIF governs media streaming, PTZ control, user management, and device configuration, replay grants full remote control of the camera.
The attack requires no interaction with the legitimate user and no credential recovery. It can be executed by any attacker with network reachability to the ONVIF endpoint and access to a captured authenticated exchange.
Root Cause
The firmware validates the PasswordDigest value cryptographically but does not maintain a nonce cache and does not enforce a Created timestamp freshness window. The WS-Security specification requires both controls to defeat capture-replay attacks. Without them, the digest becomes a static bearer credential that remains valid until the underlying password changes.
Attack Vector
An attacker positioned to observe ONVIF traffic — through network sniffing on a shared segment, a compromised upstream device, or an intercepted management session — captures a SOAP envelope containing the WS-Security header. The attacker then transmits the identical header to the camera's ONVIF endpoint at any later time. The device accepts the token and executes the requested operation. Attackers can enumerate ONVIF methods to reconfigure the device, add accounts, disable evidence capture, or pivot into connected video management systems.
No exploitation code has been described in the vendor advisory. See the GeoVision Cyber Security Overview for vendor guidance.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-88278
Indicators of Compromise
- Repeated ONVIF SOAP requests carrying identical Nonce and Created values from different source addresses or across long time windows
- Unexpected ONVIF calls to SetUser, CreateUsers, SetSystemFactoryDefault, or SetNetworkInterfaces on GV-LPC2211 devices
- Camera configuration changes, user account additions, or stream endpoint modifications without corresponding administrator activity
Detection Strategies
- Inspect ONVIF traffic at the network edge and alert when the wsse:Nonce element repeats within the retention window
- Correlate ONVIF authentication events with the source addresses of authorized management stations and flag deviations
- Baseline normal ONVIF command patterns per camera and alert on anomalous method invocations
Monitoring Recommendations
- Forward camera and VMS logs into a centralized analytics platform to preserve ONVIF request metadata
- Monitor for SOAP requests to port 80 or 8000 on GeoVision devices originating outside the management VLAN
- Track firmware version reporting across the fleet to identify devices still running V1.13
How to Mitigate CVE-2026-88278
Immediate Actions Required
- Inventory all GeoVision GV-LPC2211 devices and confirm firmware versions against V1.13
- Restrict ONVIF access to a dedicated management VLAN using strict access control lists
- Rotate ONVIF account credentials on any device where replay exposure is suspected
- Disable ONVIF on cameras that do not require third-party integration
Patch Information
Refer to the GeoVision Cyber Security Overview for firmware updates addressing the WS-Security replay weakness. Apply the vendor-provided firmware once a fixed version is released and validate that nonce reuse and stale timestamps are rejected after upgrade.
Workarounds
- Terminate ONVIF sessions through a TLS-terminating reverse proxy that enforces mutual TLS between management stations and cameras
- Place cameras behind a network segment reachable only through an authenticated jump host to prevent traffic capture
- Require IPsec or WireGuard tunnels for any ONVIF traffic that traverses shared infrastructure
- Rotate the ONVIF password on a short schedule to shrink the window during which a captured digest remains valid
# Example ACL restricting ONVIF access to a management host
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
