{"id":"CVE-2026-57879","title":"GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)","published":"2026-06-26T08:16:24.877Z","updated":"2026-10-25T22:10:00.150Z","severity":"critical","cvssScore":9.8,"epss":0.00945,"epssPct":0.61548,"kev":false,"maturity":"none","actionScore":39,"primaryVendor":"geovision inc.","primaryProduct":"gv-lpclpc2011/2211","cweId":"CWE-121","fixAvailable":false,"tags":["pre-auth","rce","memory","remote","no-ui"],"epssDelta7":0.0042,"summary":"An unauthenticated\nstack-based buffer overflow vulnerability exists in ssvr in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient bounds checking when processing RTSP custom authentication data. A\nremote attacker may exploit this vulnerability by sending a crafted RTSP\nrequest, resulting in memory corruption, denial of service, or potentially\narbitrary code execution.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Stack-based Buffer Overflow","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GV","ssvc":{"exploitation":"none","automatable":"yes","impact":"total"},"sources":{"tr":"2026-10-01T11:24:25.940Z","adp":"2026-06-26T15:57:42.515Z","cna":"2026-06-26T15:57:42.515Z","nvd":"2026-10-25T22:10:00Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:23:32.582Z"},"cvssCna":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"hasPatchRef":false,"credits":[{"name":"Jincheng Wang (@winmt), Professor Le Yu","kind":"finder","org":"Nanjing University"}],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}