Loading vulnerability…
Credential Leak in GeoVision LPC2011/LPC2211 ssi.cgi
CVE-2026-42367 is a vulnerability in the Web Interface, specifically the ssi.cgi functionality, of GeoVision LPC2011 and LPC2211 devices running firmware version 1.10. A specially crafted HTTP request can cause the application to disclose credentials, resulting in exposure of sensitive authentication material. Available reporting characterizes the issue as affecting ssi.cgi and leading to credential leakage; however, specific implementation details about the vulnerable code path or parsing logic are not currently available. The issue has also been described in some advisories as a privilege-escalation weakness because the leaked credentials can enable access to higher-privileged functionality on the device.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose credentials used by the affected GeoVision device or its web interface. Exposure of those credentials can allow an attacker to authenticate to the device, access administrative or otherwise privileged functionality, and potentially chain the issue with other vulnerabilities in the same product family for broader compromise. The direct confirmed impact is credential leakage; any subsequent privilege escalation depends on the privileges associated with the exposed credentials and the presence of additional reachable functionality.
If you can’t patch tonight, do this now.
Until a fixed firmware version can be deployed, restrict access to the device web interface to trusted management networks only, block unnecessary external and internet exposure, and enforce network segmentation around affected cameras. Limit which users and systems can reach the HTTP management interface, monitor for suspicious or malformed requests targeting ssi.cgi, and disable or isolate affected devices where operationally feasible. As a precaution, change default or weak passwords and rotate credentials regularly, especially if exposure is suspected.
Patch, then assume compromise.
Upgrade GeoVision LPC2011/LPC2211 systems from affected firmware 1.10 to a vendor-fixed release that addresses CVE-2026-42367. Apply all vendor patches associated with the GeoVision advisory set covering this issue. Because this vulnerability exposes credentials, rotate all credentials stored on or used by affected devices after patching, including administrative passwords and any reused credentials that may have been exposed. Review device configuration and access logs for signs of unauthorized access prior to remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.