Loading story…
Cisco Talos disclosed newly patched vulnerabilities in GeoVision products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans 14 advisories and 37 CVEs, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that Snort coverage is available to help detect exploitation attempts.
Reporting on the GeoVision issues highlighted critical flaws in LPC2011/LPC2211 license-plate recognition cameras and GV-VMS software. In particular, CVE-2026-42364 is an OS command injection in DdnsSetting.cgi on camera firmware 1.10, and CVE-2026-42368 is a privilege-escalation bug that can be chained for full root compromise through the web interface; a separate flaw, CVE-2026-42369, enables unauthenticated remote code execution in GV-VMS V20. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos disclosed multiple newly patched third-party vulnerabilities affecting WolfSSL, GeoVision products, and VTK-DICOM under its third-party disclosure policy. The disclosure covered three WolfSSL flaws, fourteen GeoVision advisories spanning 37 CVEs, and one VTK-DICOM vulnerability, and noted that Snort coverage is available to help detect exploitation.
A cluster of seven vulnerabilities affecting GeoVision LPC2011/LPC2211 license-plate recognition cameras and GeoVision GV-VMS software was disclosed. The disclosure included critical issues such as OS command injection (CVE-2026-42364), privilege escalation (CVE-2026-42368), and an unauthenticated RCE in GV-VMS (CVE-2026-42369).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-33848** and **CVE-2026-33849**, were disclosed in **LinkingVision rapidvms**, both classified as **CWE-119** improper restriction of operations within the bounds of a memory buffer. The flaws affect **rapidvms versions before `PR#96`** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating network-reachable exploitation with low attack complexity, no required privileges, user interaction, and potential for high impact across confidentiality, integrity, and availability. Both CVE records point to **GitHub pull request `#96`** in the `linkingvision/rapidvms` repository as the referenced fix or related remediation. Organizations running vulnerable rapidvms builds should review the changes in that pull request, identify any exposed instances, and prioritize upgrading or patching affected systems because successful exploitation could lead to severe compromise of the video management platform.
Jun 29, 2026