Loading vulnerability…
Reflected XSS in GeoVision LPC2011/LPC2211 ssi.cgi
CVE-2026-7371 is a reflected cross-site scripting vulnerability in the web interface of GeoVision LPC2011/LPC2211 version 1.10, specifically involving ssi.cgi functionality. The flaw is triggered when a specially crafted URL causes unsanitized attacker-controlled input to be reflected in an error message generated for requests to a non-existent page. Successful exploitation results in arbitrary JavaScript execution in the victim’s browser within the security context of the affected web interface.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in a victim’s browser in the context of the affected GeoVision web interface. This can enable session theft, credential capture, unauthorized actions performed as the victim, interface content manipulation, and other browser-based attacks depending on the victim’s privileges and active session state.
If you can’t patch tonight, do this now.
Until patched, reduce exposure to the web interface by restricting access to trusted administrative networks, placing the interface behind VPN or access-control boundaries, and minimizing direct user interaction with untrusted links to the device interface. Administrative users should avoid opening unsolicited URLs targeting the appliance. Web application filtering or reverse-proxy output encoding controls may reduce exploitability, but they are compensating controls and not a substitute for vendor remediation.
Patch, then assume compromise.
Apply the vendor patch for GeoVision LPC2011/LPC2211 that addresses CVE-2026-7371. Because the issue was reported as patched by the vendor, upgrading from version 1.10 to a fixed release is the primary remediation. If patch validation is required, confirm that reflected input in error handling for non-existent page requests is properly encoded or rejected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.