CVE-2026-88290: GeoVision GV-LPC2211 DoS Vulnerability

CVE-2026-88290 Overview

CVE-2026-88290 is a resource exhaustion vulnerability in GeoVision GV-LPC2211 V1.14 (260903), a license plate capture device. Unauthenticated remote clients can declare unbounded VLSVR frame lengths and indefinitely delay blocking receives. This behavior exhausts memory, connection slots, and worker resources on the target device. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption and can be triggered over the network without user interaction or credentials.

Critical Impact
Unauthenticated attackers can render the GV-LPC2211 device unavailable by exhausting server memory, connection pools, and worker threads through malformed VLSVR framing.

Affected Products

GeoVision GV-LPC2211 V1.14 (build 260903)
GeoVision VLSVR service on affected firmware
Deployments exposing the VLSVR listener to untrusted networks

Discovery Timeline

2026-09-10 - CVE-2026-88290 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88290

Vulnerability Analysis

The GV-LPC2211 VLSVR listener accepts client-supplied frame length fields without enforcing an upper bound. A remote client can announce an arbitrarily large frame and then withhold the remaining payload. The server allocates or reserves resources for the declared frame and enters a blocking receive that never completes. Each stalled connection consumes a worker thread, a socket handle, and buffer memory. Repeating the pattern across many concurrent sessions saturates the device and denies service to legitimate clients. The impact is availability loss; confidentiality and integrity are not affected.

Root Cause

The root cause is missing validation of the VLSVR frame length field combined with the absence of receive timeouts on blocking socket reads. The protocol handler trusts attacker-controlled sizing metadata and does not cap concurrent partial-frame sessions per client. This aligns with [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires only network reachability to the VLSVR port. An attacker opens multiple TCP sessions, sends a VLSVR header with an oversized length field, and then withholds the remainder of the payload. The server-side read blocks indefinitely while resources remain allocated. See the GeoVision Cyber Security Resources advisory for vendor guidance.

No verified proof-of-concept code is publicly available for this vulnerability. The exploitation pattern follows a classic slow-read resource-exhaustion model against a length-prefixed binary protocol.

Detection Methods for CVE-2026-88290

Indicators of Compromise

Sudden growth in half-open or long-lived TCP sessions to the VLSVR listener port on GV-LPC2211 devices.
Device logs showing worker thread saturation, memory pressure, or dropped legitimate client connections.
Repeated inbound connections from a small set of source addresses that transmit only a partial VLSVR header.

Detection Strategies

Baseline normal VLSVR connection counts and alert on deviations that indicate concurrent stalled sessions.
Inspect network flow telemetry for sessions with minimal client-to-server byte counts but extended durations.
Correlate device availability degradation with spikes in inbound VLSVR connection attempts.

Monitoring Recommendations

Forward device syslog and network telemetry to a centralized analytics platform for correlation.
Monitor CPU, memory, and socket-table utilization on GV-LPC2211 units for sustained anomalies.
Track ICMP or health-check failures against LPR devices as an early availability signal.

How to Mitigate CVE-2026-88290

Immediate Actions Required

Restrict network access to the VLSVR service using firewall rules that permit only known management hosts.
Place GV-LPC2211 devices on isolated VLANs and block direct exposure to the internet.
Monitor the GeoVision Cyber Security Resources page for firmware updates addressing CVE-2026-88290.

Patch Information

At the time of publication, no patched firmware version is referenced in the NVD entry. Consult the GeoVision Cyber Security Resources page for the latest firmware releases and vendor advisories affecting GV-LPC2211 V1.14 (260903).

Workarounds

Enforce per-source connection rate limits and concurrent session caps in front of the VLSVR listener.
Terminate inbound VLSVR traffic on an upstream proxy or load balancer that enforces receive timeouts.
Reboot affected devices to reclaim exhausted resources while permanent mitigations are deployed.

bash

# Example firewall restriction limiting VLSVR access to trusted management subnet
iptables -A INPUT -p tcp --dport <vlsvr_port> -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <vlsvr_port> -j DROP