CVE-2026-42368

The vulnerability results from improper authorization verification (CWE-266) in the device's web interface layer. An attacker authenticated as a user with low privilege level can send a specially crafted HTTP request that causes execution of operations reserved for the administrator. Exploiting the vulnerability only requires visiting an appropriately prepared page or sending a request to a specific web endpoint without requiring any interaction on the victim's side.

An attacker can gain full control of the device by performing privileged operations — which with a changed scope vector (Scope: Changed) can result in compromising the confidentiality, integrity and availability of both the device itself and systems associated with it.

Apply patches available from the manufacturer in accordance with the references (https://www.geovision.com.tw/cyber_security.php). Additionally, it is recommended to restrict access to the web interface of devices exclusively to trusted networks and implement multi-factor authentication mechanisms where possible.

GeoVision GV-LPC2011 and GV-LPC2211 with firmware version 1.10