CVE-2026-57878: GeoVision GV-LPC2011 and GV-LPC2211 thttpd Unauthenticated Stack-based Buffer Overflow
GeoVision GV-LPC2011 and GV-LPC2211 devices at V1.12 and earlier contain an unauthenticated stack-based buffer overflow in the thttpd web component. A remote attacker could send a crafted HTTP request with overly long input, leading to memory corruption, denial of service or potentially arbitrary code execution. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.
Overview
GeoVision GV-LPC2011 and GV-LPC2211 devices are affected by an unauthenticated stack-based buffer overflow in the thttpd web server component, tracked as CVE-2026-57878 and classified as CWE-121. The flaw stems from insufficient bounds checking when web request parameters are processed in a specific request path.
Impact
According to the CNA record, a remote attacker can send a crafted HTTP request with overly long input to cause memory corruption, denial of service or potentially arbitrary code execution. The CNA CVSS 3.1 base score is 9.8 (critical), with network attack vector, no privileges and no user interaction required, and high confidentiality, integrity and availability impact.
Affected products and versions
- GeoVision GV-LPC2011, V1.12 and earlier
- GeoVision GV-LPC2211, V1.12 and earlier
The record does not provide structured affected or fixed version data, so the list above is derived from the description text.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis, and no EPSS data is present in the record.
Remediation and mitigation
- Review the vendor cybersecurity page linked below for firmware updates and vendor guidance.
- Inventory all GV-LPC2011 and GV-LPC2211 devices and confirm their firmware versions.
- Restrict access to device web interfaces to trusted management networks and do not expose them directly to the internet.
- Use network controls to limit inbound HTTP traffic to required sources only.
- Plan isolation or replacement if no fixed firmware is available for an affected device.
The absence of a listed fixed version in the record does not mean that no fix exists.
Detection guidance
- Review web server and network logs for unusually long or malformed HTTP requests directed at these devices.
- Monitor for unexpected crashes, reboots or service interruptions, which may indicate memory corruption.
- Alert on requests from untrusted sources reaching device management interfaces.
Limitations of the available information
The record has no title, no structured affected or fixed version lists, no KEV or EPSS details beyond the absence of listing, and no vendor advisory content. The specific request path and parameters are not described, and this analysis intentionally omits technical details that would help reproduce the issue. Vendor reference: GeoVision cybersecurity page.
Frequently asked questions
Is CVE-2026-57878 being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority because of its critical CVSS score.
Which GeoVision products are affected?
The description names the GV-LPC2011 and GV-LPC2211 at V1.12 and earlier. The record does not include structured version data, so confirm firmware versions against the vendor page.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.