- The Mess: GeoVision’s GV-LPC2011 and GV-LPC2211 license-plate cameras shipped with a cluster of network-facing memory-corruption bugs. Four of them carry CVSS 9.8.
- The Damage: An attacker who can reach the camera may be able to crash services or turn memory-corruption flaws into arbitrary code execution.
- The Fix: Upgrade affected cameras from firmware V1.12 or earlier to V1.13 and remove their management interfaces from untrusted networks.
This is not one vulnerability.
GeoVision disclosed 10 CVEs affecting the GV-LPC2011 and GV-LPC2211 cameras. The disclosure covers everything from directory traversal and NULL pointer dereferences to multiple memory-corruption flaws. GeoVision lists the entire cluster under advisory GV-LPC-2026-06-01.
The four that deserve immediate attention are:
- CVE-2026-57878 — CVSS 9.8: stack-based buffer overflow in
thttpd - CVE-2026-57879 — CVSS 9.8: stack-based buffer overflow in
ssvr - CVE-2026-57880 — CVSS 9.8: stack-based buffer overflow involving RTSP Digest authentication
- CVE-2026-57881 — CVSS 9.8: another stack-based buffer overflow in the camera services
All four require no authentication and no user interaction. The vulnerable firmware line is V1.12 and earlier.
The Camera Is the Server
The GV-LPC2211 is a 2 MP network LPR camera designed to recognize license plates. It exposes web functionality, ONVIF and RTSP-related services and supports remote configuration.
That makes the security boundary fairly obvious.
The camera is not just producing video.
It is running network services.
And several of those services were parsing attacker-controlled input with insufficient bounds checking.
CVE-2026-57878 affects the embedded thttpd web server. A malicious HTTP request can trigger a stack-based buffer overflow, producing memory corruption and potentially arbitrary code execution. The published CVE record gives it a 9.8 score.
CVE-2026-57879 hits ssvr and processes RTSP custom authentication data. Again, the attacker does not need credentials. The vulnerable input reaches a stack buffer without adequate bounds checking.
CVE-2026-57880 is similar but involves RTSP Digest authentication fields. The issue can produce memory corruption, denial of service and potentially arbitrary code execution.
The fourth critical issue, CVE-2026-57881, is another stack-based overflow in the same camera family. Security vulnerability databases rate it 9.8 as well.
Ten CVEs From One Firmware Line
The critical bugs are only part of the disclosure.
CVE-2026-57872 allows unauthenticated directory traversal through get_fcont.cgi, potentially exposing files accessible to the affected process.
CVE-2026-57877 is an unauthenticated format-string vulnerability in vlsvr. Attacker-controlled login data can reach logging functionality and potentially cause information disclosure, memory corruption or denial of service. It carries CVSS 8.6.
There are also several additional unauthenticated crashes and memory-corruption bugs, including CVE-2026-57874, CVE-2026-57875 and CVE-2026-57876.
Taken together, this is less a single broken endpoint than a broad audit of the firmware’s input handling.
V1.13 Changes the Situation
There is some good news.
GeoVision released firmware V1.13, and the CVE records mark V1.13 as unaffected for the vulnerable components. GeoVision’s download portal lists V1.13 for the GV-LPC2211, with the firmware published in June 2026.
The same firmware line also appears in GeoVision’s July release notice for the LPC2011/LPC2211 family.
Administrators should therefore check the firmware version rather than simply assuming the camera is safe because it sits behind an NVR.
If the device is running V1.12 or older, it belongs on the patch list.
Don’t Expose the Camera
Even after upgrading, these cameras should not be directly reachable from the public internet.
Put LPR infrastructure behind network controls.
Restrict:
- HTTP/HTTPS administration to trusted management hosts
- RTSP access to authorized recording systems
- ONVIF access to known devices
- camera-to-internet traffic unless explicitly required
- lateral access from ordinary workstation networks
Then verify that old firmware has actually disappeared from the fleet.
A forgotten camera running V1.12 can be more interesting to an attacker than a fully monitored workstation.
Bugstoday Opinion
The most interesting number here isn’t the 9.8.
It’s ten.
Ten vulnerabilities landed against the same firmware line, with four separate critical memory-corruption bugs capable of potentially crossing the line from denial of service into code execution.
Embedded cameras keep getting treated as appliances.
Attackers treat them as computers.
The second view is the one that matters.
If a camera accepts network traffic, parses complex protocols and runs multiple native services, it belongs in the vulnerability-management program — not in the “it’s just a camera” category.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- GeoVision — GV-LPC-2026-06-01 Security Advisory
- NVD — CVE-2026-57872 through CVE-2026-57881
- GeoVision — GV-LPC2211 Firmware V1.13
- INCIBE-CERT — GeoVision GV-LPC2011/LPC2211 vulnerabilities
- OpenCVE — GeoVision GV-LPC2011/LPC2211
