External risk intelligence

GeoVision GV-LPC Stack Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57880

The affected product is a network-connected camera or video surveillance device. RTSP services on such devices are designed to be accessed over network interfaces, often exposed to the internet for remote monitoring and management purposes, making this a public-facing service by design.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in GeoVision surveillance camera systems that could allow remote attackers to disrupt operations or potentially execute unauthorized code. The issue stems from how the system handles authentication requests, making it susceptible to specially crafted network commands. The main concern is confirming whether these specific devices are in use and exposed.

Unauthenticated attackers can crash or control cameras.
Critical remote access flaw in surveillance systems.
Confirm if specific surveillance cameras are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted RTSP request to the affected device over the network. This request, containing excessively long authentication data, targets a weakness in how the device processes RTSP Digest authentication fields. Successful exploitation could lead to memory corruption, a denial of service, or potentially allow an attacker to execute their own code on the device.

No authentication required to access.
Crafted RTSP request triggers overflow.
Risk of memory corruption or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to crash the affected surveillance system or potentially gain control by sending specially crafted network requests that exploit a buffer overflow. This could disrupt video monitoring services when the system is exposed to the internet.

Video surveillance service disruption.
Network requests could trigger overflow.
Potential for unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The GeoVision GV-LPC2011 and GV-LPC2211 devices are likely managed by the Video Surveillance or Infrastructure teams, with ultimate accountability resting with the Asset Owner. Initial steps should focus on identifying all instances of the affected technology, assessing their network exposure and business criticality, and confirming the accountable owner before planning remediation.

Own by: Video surveillance or infrastructure teams.
Verify first: Network exposure and business criticality.
Action: Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GeoVision GV-LPC2011 and GV-LPC2211?

These are specialized network-connected surveillance cameras used for license plate capture and video monitoring. They run a service called ssvr, which manages video streaming and system authentication, allowing the devices to integrate into broader security and infrastructure environments for remote observation.

What is the buffer overflow weakness in CVE-2026-57880?

This is a stack-based buffer overflow, categorized as CWE-121. It occurs when the device's software lacks proper size limits while processing data. In this specific case, the camera fails to check the length of authentication information in an RTSP request, causing the system to overwrite adjacent memory, which can lead to system crashes or unauthorized command execution.

How does an attacker trigger this vulnerability?

An attacker sends a specially prepared RTSP request to the camera that includes an excessively long authentication string. The flaw is specifically triggered during the Digest authentication parsing phase. Simply connecting to the camera or viewing a video stream without sending this malformed authentication data does not trigger the overflow.

Do I need to worry if my cameras are not on the internet?

Halo Surface Signal indicates that these devices are designed for network-based remote monitoring, making them frequent candidates for internet exposure. If your devices are restricted to an internal network without internet access, the likelihood of a remote attacker reaching the service is significantly reduced compared to devices directly reachable via public IP addresses.

When should I take action for this GeoVision vulnerability?

You should prioritize this by first verifying your inventory to see if you are running version 1.12 or earlier of the GV-LPC series. Collaborate with your video surveillance or infrastructure teams to identify which units are deployed. Once identified, assess their network connectivity and business importance to determine the urgency of applying upcoming security updates.

References

www.geovision.com.tw/cyber_security.php

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.