CVE-2026-88281: GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service
Published Sep 10, 2026
·Updated
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
Affected Software
1 affected component
GeoVision GV-LPC2211=1.13
Event History
Sep 10, 2026
CVE Published
via MITRE·08:22 AM
Data Sourced
via MITRE·08:22 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated as an administrator and able to send ONVIF DeleteUsers requests to the affected device. The available data does not indicate that unauthenticated users can trigger it.
2
What is the operational impact of successful exploitation?
Successful exploitation can crash the ONVIF worker, causing a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
3
How can I determine whether a device is affected?
The reported affected product and version is GeoVision GV-LPC2211 V1.13. The issue is triggered by DeleteUsers requests containing repeated Username elements.