{"id":"CVE-2026-57877","title":"GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)","published":"2026-06-26T08:16:24.667Z","updated":"2026-10-25T22:10:00.150Z","severity":"high","cvssScore":8.6,"epss":0.00433,"epssPct":0.3809,"kev":false,"maturity":"none","actionScore":34,"primaryVendor":"geovision inc.","primaryProduct":"gv-lpclpc2011/2211","cweId":"CWE-134","fixAvailable":false,"tags":["pre-auth","remote","no-ui"],"epssDelta7":0.0019,"summary":"An unauthenticated\nformat string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and\nGV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling\nof externally controlled input during log message formatting in the login\nprocessing path. A remote attacker may exploit this vulnerability by sending\ncrafted login data, potentially causing information disclosure, memory\ncorruption, or a denial of service.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Use of Externally-Controlled Format String","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GV","ssvc":{"exploitation":"none","automatable":"yes","impact":"partial"},"sources":{"tr":"2026-10-01T11:24:25.940Z","adp":"2026-06-26T15:42:18.428Z","cna":"2026-06-26T15:42:18.428Z","nvd":"2026-10-25T22:10:00Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:23:30.517Z"},"cvssCna":{"score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"hasPatchRef":false,"credits":[{"name":"Jincheng Wang (@winmt), Professor Le Yu","kind":"finder","org":"Nanjing University"}],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}