CVE-2026-88284: GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Denial of Service
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to send ONVIF SetUser requests while authenticated as an administrator. The provided information does not indicate that unauthenticated or lower-privileged users can exploit it.
What is the operational impact of successful exploitation?
Repeated User elements can overwrite stack control state and crash the ONVIF worker, resulting in a denial of service. No confidentiality or integrity impact is described.
How can I determine whether a device is affected?
The affected software identified is GeoVision GV-LPC2211 version 1.13. Devices running that version should be evaluated, especially where administrator-level ONVIF access is available.
What can be done if patching is not immediately possible?
Restrict ONVIF access to trusted administrative users and limit network reachability to the ONVIF service. This reduces the opportunity for an attacker to submit malicious SetUser requests.