CVE-2026-88281: GeoVision GV-LPC2211 Buffer Overflow Flaw

CVE-2026-88281 Overview

CVE-2026-88281 is a stack-based buffer overflow [CWE-121] in the GeoVision GV-LPC2211 V1.13 license plate camera. The device fails to limit the number of repeated Username elements accepted in an ONVIF DeleteUsers request. An authenticated administrator can submit a crafted Simple Object Access Protocol (SOAP) request that overflows a fixed-size stack array in the ONVIF worker process. The overflow crashes the worker, producing a denial of service condition on the camera's ONVIF management interface.

Critical Impact
An authenticated administrator can crash the ONVIF worker process on the GV-LPC2211 V1.13, disrupting device management and video surveillance operations over the network.

Affected Products

GeoVision GV-LPC2211 license plate capture camera, firmware V1.13
ONVIF worker service on the affected device
Deployments exposing the ONVIF management interface to network-reachable administrators

Discovery Timeline

2026-09-10 - CVE-2026-88281 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88281

Vulnerability Analysis

The flaw resides in the ONVIF service implementation on the GV-LPC2211. ONVIF defines a standard SOAP-based interface for user administration on IP cameras. The DeleteUsers operation accepts one or more Username child elements identifying the accounts to remove. The GV-LPC2211 firmware copies each supplied Username into a fixed-size stack array without enforcing an upper bound on the element count. Submitting a request with an excessive number of Username elements writes past the array boundary and corrupts adjacent stack memory. The ONVIF worker terminates, and management functions dependent on the worker become unavailable until the service restarts.

Root Cause

The root cause is missing input validation on the count of repeated SOAP elements. The parser trusts the client-supplied element list length and iterates the copy loop without a bounds check against the destination array size. This pattern maps directly to CWE-121, stack-based buffer overflow, driven by an unbounded array write.

Attack Vector

Exploitation requires network access to the ONVIF endpoint and valid administrator credentials. The attacker sends a single SOAP DeleteUsers request populated with a large number of Username elements. The worker processes the request, overflows the stack array, and crashes. Confidentiality and integrity are not affected; the observed impact is loss of ONVIF service availability. Verified proof-of-concept code is not published in the referenced advisory, and no public exploit is listed.

// No verified exploitation code is published for CVE-2026-88281.
// Vulnerability mechanism (prose):
//   POST /onvif/device_service HTTP/1.1
//   SOAP Body: <DeleteUsers><Username>...</Username> x N </DeleteUsers>
// When N exceeds the fixed stack array capacity, the copy loop writes
// past the array boundary, corrupting the stack and crashing the worker.

Detection Methods for CVE-2026-88281

Indicators of Compromise

Unexpected termination or restart of the ONVIF worker process on GV-LPC2211 devices
Loss of ONVIF management responsiveness following an administrator-authenticated SOAP request
Camera logs recording repeated DeleteUsers requests from a single source in a short window

Detection Strategies

Inspect ONVIF SOAP traffic for DeleteUsers requests containing an abnormally high count of Username elements
Alert on ONVIF service crashes or watchdog-triggered restarts on GeoVision devices
Correlate administrator authentication events with subsequent ONVIF availability failures

Monitoring Recommendations

Forward camera syslog and device health telemetry to a centralized log platform for retention and analysis
Baseline normal ONVIF request volumes and element counts per administrator account, then alert on deviations
Monitor network segments hosting IP cameras for unauthorized clients attempting ONVIF authentication

How to Mitigate CVE-2026-88281

Immediate Actions Required

Restrict network reachability of the ONVIF management interface to trusted administrative hosts only
Rotate administrator credentials on GV-LPC2211 devices and remove unused accounts
Review the GeoVision Cyber Security Overview for vendor firmware updates addressing this issue

Patch Information

Refer to the GeoVision Cyber Security Overview for the current firmware release status for the GV-LPC2211. Apply any firmware update that supersedes V1.13 once published by the vendor and validated in a test environment.

Workarounds

Place cameras on an isolated management VLAN and block ONVIF ports from general user networks
Enforce firewall access control lists limiting ONVIF connections to a small set of management workstations
Disable or restrict administrator accounts that are not required for daily operations to reduce the pool of credentials that could trigger the flaw

bash

# Example: restrict ONVIF (port 80/tcp SOAP) to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP