External risk intelligence

GeoVision GV-LPC2211 UsernameToken Replay Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-88278

The vulnerability affects an IP camera, which is a network-connected appliance frequently deployed with public internet access for remote monitoring and external management via ONVIF protocols.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security flaw found in GeoVision's GV-LPC2211 V1.13, specifically its failure to properly secure user authentication. This oversight could allow an attacker to reuse captured credentials to perform unauthorized operations on the device, potentially impacting its intended functionality.

Replayable passwords allow unauthorized access.
Critical flaw impacts network-connected devices.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by capturing network traffic containing a valid PasswordDigest token. This token can then be replayed to authenticate and perform unauthorized ONVIF operations on the affected device.

Unauthenticated network access required.
Replay captured PasswordDigest token.
Unauthorized ONVIF operations.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to replay a captured PasswordDigest token to perform subsequent ONVIF operations without needing the original credentials. This could occur when the WS-Security UsernameToken is not adequately protected against reuse.

Camera authentication.
Replaying a captured PasswordDigest.
Unauthorized access to camera functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects GeoVision IP cameras that utilize ONVIF for operations. Ownership of this issue typically falls to the team managing the camera infrastructure, often the network or security team, in coordination with the application owner responsible for the surveillance system. The first practical step is to identify all deployed cameras using the affected technology, confirm their network exposure, and assess business criticality to prioritize remediation efforts.

Network and security teams own resolution.
Verify camera network exposure and criticality.
Plan for phased remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GeoVision GV-LPC2211?

The GeoVision GV-LPC2211 is a specialized IP camera designed for license plate capture and traffic monitoring. It is part of the broader GeoVision surveillance ecosystem, allowing users to integrate the device into larger security networks using the ONVIF standard, which provides a common language for IP-based physical security products to communicate with management software.

How does CVE-2026-88278 impact security?

This flaw is classified as CWE-294, or Authentication Bypass by Capture-replay. In plain terms, the camera fails to verify if an authentication token is being used for the first time or if it has been used previously. An attacker can intercept a valid authentication request and reuse that same data to gain unauthorized access, effectively impersonating a legitimate user without needing to know their actual password.

When does this replay vulnerability occur?

The issue is triggered when an attacker captures a PasswordDigest token from network traffic. It is important to note that the camera does not require the attacker to have the original plaintext password to succeed. Simply possessing a previously captured, valid token is sufficient to bypass authentication. Legitimate use of the camera by an authorized operator does not trigger the bug; only the subsequent replay of that captured traffic does.

Why is this a concern for my network?

According to Halo Surface Signal, this vulnerability is considered a likely risk because these cameras are network-connected appliances often deployed with public-facing internet access to support remote monitoring. If your camera is reachable over the internet, the window for an attacker to capture traffic and perform unauthorized ONVIF operations is significantly wider than for devices restricted to an internal-only network.

What should I do if I use this camera?

Begin by inventorying your environment to locate all instances of the GV-LPC2211 running version V1.13. Once identified, verify if these devices are exposed to the public internet or accessible via untrusted segments of your network. Coordinate with your security or infrastructure team to restrict access to only essential systems while you work with the manufacturer to monitor for official guidance or firmware updates.

References

www.geovision.com.tw/cyber_security.php

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.