Loading vulnerability…
Authentication Bypass via Guessable Session Cookies in GeoVision LPC2011/LPC2211 Web Interface
CVE-2026-42365 is a guessable session cookie vulnerability in the Web Interface of GeoVision LPC2011 and LPC2211 devices running version 1.10. The flaw stems from insufficient unpredictability in session identifiers, allowing an attacker to brute-force valid session cookies through a specially crafted series of HTTP requests. By successfully predicting or enumerating active session values, an unauthenticated attacker can bypass normal authentication controls and obtain access to an authenticated web session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows authentication bypass and unauthorized access to the affected web interface. Because the vulnerability permits an attacker to assume a valid session without legitimate credentials, it can expose sensitive information available to authenticated users. The available scoring information indicates high confidentiality impact, with no specific evidence provided for direct integrity or availability impact from this flaw alone.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to the web interface to trusted management networks only, remove direct internet exposure, enforce network segmentation around the affected cameras, and monitor for repeated or anomalous HTTP requests consistent with session brute-forcing. Reducing exposure of the administrative interface and limiting reachable clients can materially reduce exploitability until a fixed firmware version is deployed.
Patch, then assume compromise.
Upgrade affected GeoVision LPC2011/LPC2211 devices from version 1.10 to a vendor-provided patched release that corrects session generation and session management weaknesses. Apply all GeoVision security updates associated with this issue and verify that session identifiers are regenerated and invalidated appropriately after authentication and logout.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.