Loading story…
GeoVision disclosed security vulnerabilities affecting its GV-LPC2011 and GV-LPC2211 control-system devices. The Canadian Centre for Cyber Security issued advisory AV26-913, identifying firmware version 1.13 as affected as of September 10, 2026; no CVE identifiers, severity ratings, vulnerability types, or evidence of exploitation were provided in the public notice.
Administrators should review GeoVision Security Advisory GV-LPC-2026-09-01 and apply vendor-provided updates when available. Organizations using the affected devices should identify exposed or operationally critical deployments, prioritize remediation, and monitor vendor guidance for additional technical details.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published control-systems advisory AV26-913 concerning the GeoVision vulnerabilities and advised users and administrators to review GeoVision's advisory and apply applicable updates when available.
As of September 10, 2026, GeoVision GV-LPC2011/LPC2211 devices running firmware version 1.13 were reported as affected by vulnerabilities. GeoVision's GV-LPC-2026-09-01 security advisory was referenced for technical and remediation details.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcedlcdn.geovision.com.tw
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026
An authentication bypass vulnerability, tracked as CVE-2025-10538, has been identified in LG Innotek camera models LND7210 and LNV7210R. This flaw allows remote attackers to gain unauthorized access to sensitive camera information, including user account details. The vulnerability is rated as high severity, with a CVSS v4 score of 8.8, indicating significant risk if exploited. Both affected camera models are widely deployed in commercial facilities and are used globally, increasing the potential impact of this security issue. The vulnerability can be exploited remotely and requires low attack complexity, meaning attackers do not need advanced skills or physical access to compromise the devices. Successful exploitation could grant an attacker administrative access, enabling them to manipulate camera settings, access video feeds, or harvest user credentials. The vulnerability is categorized under CWE-288, which involves authentication bypass using an alternate path or channel. All versions of the LND7210 and LNV7210R models are affected, and there are no unaffected versions available. The issue was reported to CISA by security researcher Souvik Kandar, highlighting the importance of coordinated vulnerability disclosure. LG Innotek has acknowledged the vulnerability but has stated that these camera models are end-of-life products and will not receive security patches. As a result, organizations using these cameras are advised to consider device replacement or network segmentation to mitigate risk. The vulnerability's presence in end-of-life products underscores the ongoing security challenges posed by legacy devices in critical infrastructure environments. CISA has issued an advisory to inform stakeholders and recommend mitigation strategies. The widespread deployment of these cameras in commercial sectors and their unpatchable status elevate the urgency for asset owners to take immediate action. Organizations should review their inventories for affected models and implement compensating controls where possible. The disclosure of this vulnerability serves as a reminder of the risks associated with unsupported hardware in operational environments. Security teams are encouraged to monitor for signs of exploitation and to prioritize the decommissioning of vulnerable devices. The incident highlights the need for proactive lifecycle management and regular security assessments of connected devices.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026