Patched GeoVision Camera and VMS Flaws Enable Root Compromise and RCE

Cisco Talos disclosed newly patched vulnerabilities in GeoVision products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans 14 advisories and 37 CVEs, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that Snort coverage is available to help detect exploitation attempts.

Reporting on the GeoVision issues highlighted critical flaws in LPC2011/LPC2211 license-plate recognition cameras and GV-VMS software. In particular, CVE-2026-42364 is an OS command injection in DdnsSetting.cgi on camera firmware 1.10, and CVE-2026-42368 is a privilege-escalation bug that can be chained for full root compromise through the web interface; a separate flaw, CVE-2026-42369, enables unauthenticated remote code execution in GV-VMS V20. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.