Loading vulnerability…
Privilege Escalation in GeoVision LPC2011/LPC2211 Web Interface
CVE-2026-42368 is a privilege escalation vulnerability in the web interface of GeoVision LPC2011 and LPC2211 license-plate recognition cameras running firmware version 1.10. The flaw can be triggered by a specially crafted HTTP request and allows execution of privileged operations through the device’s web interface. Available reporting identifies the issue as residing in web interface functionality rather than a lower-level network service, but does not provide the exact vulnerable function or parameter. The vulnerability is remotely reachable over the network and is rated with low attack complexity. Available scoring information indicates exploitation requires low privileges and can result in compromise with changed scope and high impact to confidentiality, integrity, and availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to perform privileged operations on the affected camera through the web interface. Given the assigned CVSS impacts of high confidentiality, integrity, and availability, exploitation can enable broad compromise of the device, including unauthorized access to sensitive information, modification of configuration or system state, and disruption of camera operation. Reporting also indicates this flaw can be chained with other GeoVision camera vulnerabilities to achieve full root-level compromise through the web interface.
If you can’t patch tonight, do this now.
Until patched firmware can be deployed, restrict access to the camera web interface to trusted administrative networks only, remove direct internet exposure, and enforce network segmentation between camera infrastructure and adjacent enterprise or physical-security systems. Limit access with firewall rules or VPN-based administration, disable unnecessary remote management paths where feasible, replace default or weak credentials, and monitor for suspicious or unexpected HTTP requests targeting the web interface.
Patch, then assume compromise.
Upgrade affected GeoVision LPC2011/LPC2211 devices from firmware 1.10 to a vendor-fixed release. Available reporting indicates patched versions were issued by the vendor, and firmware version 1.2 is identified as unaffected for this CVE. Apply the vendor’s security updates across all exposed devices and verify that vulnerable firmware is no longer deployed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.