CVE-2026-88284: GeoVision GV-LPC2211 DOS Vulnerability

CVE-2026-88284 Overview

CVE-2026-88284 is a stack-based buffer overflow [CWE-121] in the GeoVision GV-LPC2211 V1.13 license plate capture device. The device's ONVIF service fails to bound repeated User elements inside SetUser requests. An authenticated administrator can send a crafted request that overwrites stack control state and crashes the ONVIF worker process.

The flaw affects the availability of the ONVIF management interface but does not directly expose confidentiality or integrity of stored data. Exploitation requires network access to the ONVIF endpoint and valid administrator credentials.

Critical Impact
Authenticated administrators can crash the ONVIF worker on GeoVision GV-LPC2211 V1.13, disrupting camera management and integration workflows.

Affected Products

GeoVision GV-LPC2211 V1.13
GeoVision ONVIF service on affected firmware
Downstream video management systems relying on the ONVIF endpoint

Discovery Timeline

2026-09-10 - CVE-2026-88284 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88284

Vulnerability Analysis

The GV-LPC2211 exposes an ONVIF service that accepts SOAP requests, including SetUser operations for managing device accounts. The parser for SetUser iterates over each User element in the request but does not enforce an upper limit on the number of repeated entries.

When an administrator submits a request containing an excessive count of User elements, the parser writes beyond a fixed-size stack buffer. The overflow corrupts stack-resident control data such as saved registers and return addresses, terminating the ONVIF worker.

The crash removes the ONVIF management surface until the service or device restarts. Video management platforms that depend on ONVIF for configuration lose control of the affected camera during the outage.

Root Cause

The root cause is missing input validation on the count and cumulative size of User elements in ONVIF SetUser payloads. The parser copies element data into a stack buffer without tracking capacity, matching the classical stack-based buffer overflow pattern described in [CWE-121].

Attack Vector

Exploitation requires network reachability to the ONVIF port and valid administrator credentials. The attacker sends a SOAP SetUser request containing many repeated User elements, triggering the overflow and crashing the worker. No user interaction is required.

Because the required privilege level is administrator, the vulnerability primarily represents a denial-of-service risk from compromised or misused administrator accounts rather than an unauthenticated network attack. Refer to the GeoVision Cyber Security Resource for vendor detail.

Detection Methods for CVE-2026-88284

Indicators of Compromise

Unexpected termination or restart of the ONVIF worker process on GV-LPC2211 devices
ONVIF SetUser SOAP requests with an unusually high count of repeated User elements
Loss of ONVIF connectivity from video management systems while the device remains network reachable
Repeated administrator authentications from atypical source addresses immediately before service crashes

Detection Strategies

Inspect SOAP traffic to ONVIF endpoints for SetUser payloads exceeding a reasonable User element count
Correlate ONVIF service restarts with authenticated administrator sessions and originating IP addresses
Alert when video management systems report loss of ONVIF control channel to specific cameras

Monitoring Recommendations

Forward ONVIF service logs and system crash events from GV-LPC2211 devices to a central log platform
Baseline normal SetUser request sizes and alert on statistical outliers
Track administrator credential usage against the ONVIF interface and flag unusual patterns

How to Mitigate CVE-2026-88284

Immediate Actions Required

Restrict network access to the ONVIF service to trusted management subnets using firewall or VLAN segmentation
Rotate administrator credentials on affected GV-LPC2211 devices and enforce unique per-device passwords
Monitor the GeoVision Cyber Security Resource for firmware updates addressing this issue
Disable unused ONVIF user management features where the deployment does not require them

Patch Information

No patch identifier is listed in the enriched NVD entry at publication. Administrators should consult the GeoVision Cyber Security Resource for firmware releases superseding V1.13 that address the ONVIF SetUser parser.

Workarounds

Place GV-LPC2211 devices behind a management gateway that filters ONVIF SOAP requests and enforces schema limits
Limit the number of accounts with administrator privileges on each device to reduce the credential attack surface
Configure video management systems to automatically restart the ONVIF session if the endpoint becomes unresponsive

bash

# Example firewall rule restricting ONVIF access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP