CVE-2026-88287: GeoVision GV-LPC2211 DoS Vulnerability

CVE-2026-88287 Overview

CVE-2026-88287 is a stack-based buffer overflow [CWE-121] affecting the GeoVision GV-LPC2211 license plate capture camera running firmware V1.13. The device fails to bound the number of Scopes tokens accepted in unauthenticated ONVIF WS-Discovery Probe requests. A remote attacker can send a crafted Probe message that corrupts stack control state and crashes the discovery process. Exploitation requires no authentication and no user interaction, and it can be triggered across the network wherever the ONVIF discovery service is reachable. The result is a denial of service against the camera's discovery functionality.

Critical Impact
An unauthenticated remote attacker can crash the ONVIF WS-Discovery process on GeoVision GV-LPC2211 V1.13 by sending a Probe request containing an excessive number of Scopes tokens.

Affected Products

GeoVision GV-LPC2211 license plate capture camera
Firmware version V1.13
ONVIF WS-Discovery service exposed on the device

Discovery Timeline

2026-09-10 - CVE-2026-88287 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88287

Vulnerability Analysis

The vulnerability resides in the ONVIF WS-Discovery handler on the GeoVision GV-LPC2211 V1.13. ONVIF WS-Discovery is a UDP-based multicast protocol that lets clients locate cameras and other physical security devices on a local network. When a device receives a Probe request, it parses the SOAP envelope, including any Scopes tokens embedded in the message.

The handler does not enforce an upper bound on the number of Scopes tokens it will process. Supplying a very large token list causes writes past a fixed-size stack buffer during parsing. This corrupts stack control state, including saved return addresses or frame pointers, and crashes the discovery process.

The crash removes the discovery service from operation until the process or device is restarted. The CVSS vector limits impact to availability, so the recorded risk is a denial of service rather than code execution.

Root Cause

The root cause is missing input validation on the count of Scopes elements inside an ONVIF WS-Discovery Probe message. The parser copies token data into a stack-allocated buffer without validating that the number of tokens fits within the destination. This is a classic stack-based buffer overflow pattern classified under [CWE-121].

Attack Vector

An attacker on the same network segment, or any network path reachable by the camera's WS-Discovery listener, sends a single crafted SOAP Probe message containing an oversized list of Scopes tokens. No credentials, session, or user interaction are required. The message reaches the discovery service, triggers the overflow during parsing, and terminates the process.

Because WS-Discovery typically uses UDP multicast on port 3702, the attack does not require a completed TCP handshake and can be delivered with a single packet flight. Public technical details are limited to the vendor advisory referenced by the GeoVision Cyber Security Overview.

Detection Methods for CVE-2026-88287

Indicators of Compromise

Unexpected restarts or crash logs from the ONVIF WS-Discovery service on GV-LPC2211 cameras.
Inbound UDP traffic to port 3702 from sources outside the video management system (VMS) subnet.
SOAP Probe requests containing anomalously large numbers of <d:Scopes> elements.
Gaps in device availability or ONVIF discovery telemetry reported by the VMS.

Detection Strategies

Inspect UDP/3702 traffic with a network sensor and alert on Probe messages whose Scopes element count exceeds a small threshold consistent with legitimate clients.
Correlate camera process crashes and reboots with inbound WS-Discovery traffic timestamps to identify triggering packets.
Baseline the set of hosts that legitimately issue ONVIF Probe requests, and alert on any new source addresses.

Monitoring Recommendations

Forward camera syslog and VMS event logs to a central store for correlation with network telemetry.
Monitor for repeated Probe requests from a single source within short time windows, which suggests scripted abuse.
Track ONVIF service uptime and Probe response rates per camera to detect availability degradation.

How to Mitigate CVE-2026-88287

Immediate Actions Required

Restrict UDP/3702 traffic to the GV-LPC2211 so only authorized VMS hosts can reach the ONVIF WS-Discovery service.
Place camera subnets behind a dedicated VLAN with no direct exposure to user or internet-facing networks.
Inventory all GeoVision GV-LPC2211 devices and confirm firmware versions to identify units running V1.13.
Monitor the GeoVision Cyber Security Overview page for a firmware update addressing this issue.

Patch Information

At the time of publication, no fixed firmware version is listed in the NVD entry for CVE-2026-88287. Administrators should consult the GeoVision Cyber Security Overview for advisory updates and apply any released firmware for the GV-LPC2211 that addresses the WS-Discovery Scopes parsing flaw.

Workarounds

Block or rate-limit inbound UDP traffic to port 3702 at network chokepoints between camera subnets and other zones.
Disable ONVIF discovery on cameras where the VMS uses static configuration and does not require dynamic discovery.
Apply access control lists on switches to permit WS-Discovery traffic only from known VMS addresses.
Segment the camera network so that a crash in one device's discovery service cannot be triggered from user workstations.

bash

# Configuration example: restrict WS-Discovery to a trusted VMS host
# Replace CAMERA_SUBNET and VMS_HOST with values from your environment
iptables -A FORWARD -p udp --dport 3702 -s VMS_HOST -d CAMERA_SUBNET -j ACCEPT
iptables -A FORWARD -p udp --dport 3702 -d CAMERA_SUBNET -j DROP