CVE Intelligence
Analysis AI-assisted

CVE-2026-57881: GeoVision GV-LPC2011/GV-LPC2211 vlsvr Stack-Based Buffer Overflow

A critical, unauthenticated stack-based buffer overflow in the vlsvr component of GeoVision GV-LPC2011 and GV-LPC2211 (V1.12 and earlier) can be triggered remotely through crafted login data. The CNA assigned CVSS 3.1 base score 9.8. The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-57881 describes an unauthenticated stack-based buffer overflow (CWE-121) in vlsvr, a component of GeoVision GV-LPC2011 and GV-LPC2211 at V1.12 and earlier. According to the record, the flaw comes from insufficient length validation when remote login data is processed.

Impact

  • The CNA-provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8.
  • The description states that exploitation may result in memory corruption, denial of service or, potentially, arbitrary code execution.

Affected products and versions

  • GeoVision GV-LPC2011 and GV-LPC2211, V1.12 and earlier, as described in the record.
  • The record contains no structured affected or fixed version data, so the affected and fixes lists are empty.

Exploitation status

  • The record does not list this CVE in CISA KEV. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Check the vendor security page for updates and guidance: GeoVision cyber security.
  • Inventory all GV-LPC2011 and GV-LPC2211 units and compare their versions with the vendor statement.
  • Reduce network exposure of the login service: keep it off the public internet, place it behind segmented management networks or VPN, and restrict permitted source addresses.
  • Apply these compensating controls until a vendor fix is verified and installed.

Detection guidance

  • Review logs and network telemetry for unusual or unexpectedly long login attempts directed at the management interface.
  • Alert on unexpected crashes, restarts or loss of availability of the affected products.
  • Investigate unexpected outbound connections or configuration changes originating from these products as possible indicators of compromise.

Limitations of the available information

  • The record does not identify a fixed version, patch availability or the vendor's own confirmation of the issue.
  • The record status is Deferred, and EPSS and SSVC data are absent.
  • Affected versions are described only in prose, not in structured data.

Frequently asked questions

What is CVE-2026-57881?

It is an unauthenticated stack-based buffer overflow in the vlsvr component of GeoVision GV-LPC2011 and GV-LPC2211, affecting V1.12 and earlier according to the record. The flaw stems from insufficient length validation of remote login data.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. This status may change, so monitoring vendor and government sources is advisable.

What should administrators do now?

Check the vendor security page, inventory affected products, and reduce network exposure of the login service. Confirm a vendor fix before considering the issue resolved, because the record does not list one.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.