CVE-2026-88279: GeoVision GV-LPC2211 DoS Vulnerability

CVE-2026-88279 Overview

CVE-2026-88279 is a stack-based buffer overflow [CWE-121] in the GeoVision GV-LPC2211 license plate capture camera running firmware V1.13. The device copies oversized username or password values from ONVIF CreateUsers requests into fixed-size stack fields without bounds checking. An authenticated administrator can send crafted ONVIF requests that overflow these fields and crash the ONVIF worker process. The result is a denial-of-service condition affecting availability of the camera's ONVIF interface.

Critical Impact
An authenticated administrator can crash the ONVIF worker process on GeoVision GV-LPC2211 V1.13 devices, disrupting video management integrations that rely on the ONVIF protocol.

Affected Products

GeoVision GV-LPC2211 firmware V1.13
GeoVision ONVIF worker service on affected firmware
Downstream video management systems integrating over ONVIF with the affected device

Discovery Timeline

2026-09-10 - CVE-2026-88279 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88279

Vulnerability Analysis

The flaw resides in the ONVIF CreateUsers request handler on the GeoVision GV-LPC2211 V1.13. ONVIF is an open protocol used by IP cameras and video management systems to standardize device configuration and streaming. The CreateUsers operation accepts a Username and Password element inside a SOAP request. The vulnerable handler copies these string values into fixed-size stack buffers without validating input length. Supplying values that exceed the destination buffer size overwrites adjacent stack memory. This corrupts the process stack frame and terminates the ONVIF worker. Because the attack requires valid administrator credentials, impact is bounded to availability of the ONVIF service rather than confidentiality or integrity.

Root Cause

The root cause is missing bounds checking on user-controlled string inputs before they are copied into fixed-length stack fields. This is a classic stack-based buffer overflow pattern classified under [CWE-121]. The handler trusts the length of the Username and Password values as delivered in the ONVIF SOAP body rather than enforcing a maximum size aligned with the destination buffer.

Attack Vector

Exploitation requires network reachability to the ONVIF service and valid administrator credentials on the target device. An attacker with those preconditions issues a SOAP CreateUsers request containing an oversized Username or Password string. The oversized field overflows the destination stack buffer and crashes the ONVIF worker. No user interaction is required, and no confidentiality or integrity impact has been reported. No public exploit or proof-of-concept has been published.

See the GeoVision Cyber Security Overview for vendor advisory information.

Detection Methods for CVE-2026-88279

Indicators of Compromise

Unexpected termination or repeated restarts of the ONVIF worker process on GeoVision GV-LPC2211 devices
ONVIF SOAP requests to the CreateUsers operation containing abnormally long Username or Password elements
Loss of ONVIF connectivity from video management systems while the underlying network path remains reachable

Detection Strategies

Inspect HTTP or HTTPS traffic to camera ONVIF endpoints for SOAP CreateUsers bodies with Username or Password values exceeding realistic length thresholds
Correlate administrator authentication events with subsequent ONVIF service crashes to identify abuse of privileged credentials
Baseline normal ONVIF request patterns and alert on anomalous CreateUsers operations from unexpected source addresses

Monitoring Recommendations

Forward camera and network telemetry into a centralized analytics platform to correlate authentication, request payloads, and service health
Monitor availability of the ONVIF service through active health checks from the video management system
Track failed and successful administrator logins against camera management interfaces

How to Mitigate CVE-2026-88279

Immediate Actions Required

Restrict network access to the ONVIF port on GeoVision GV-LPC2211 devices to trusted management hosts only
Rotate administrator credentials and enforce strong, unique passwords on affected cameras
Review administrator account inventory and remove unused or shared accounts on the device
Monitor ONVIF worker process health and alert on unexpected restarts

Patch Information

No patch information is included in the current NVD record. Consult the GeoVision Cyber Security Overview for firmware updates and vendor guidance for the GV-LPC2211 product line.

Workarounds

Place affected cameras on an isolated management VLAN reachable only by the video management system
Block ONVIF service ports at the network perimeter and internal firewalls except from authorized subnets
Limit the number of accounts with administrator privileges on the camera to reduce the attack surface

bash

# Example firewall rule restricting ONVIF access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP