GeoVision LPC Camera Critical RCE via thttpd Buffer Overflow (CVE-2026-57878)

Executive Summary

A critical unauthenticated stack-based buffer overflow vulnerability has been disclosed in the thttpd web server component of GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras running firmware V1.12 and earlier. Tracked as CVE-2026-57878 with a CVSS score of 9.8 (Critical), this vulnerability allows a remote, unauthenticated attacker to potentially execute arbitrary code on affected devices.

CVSS Score: 9.8 (Critical)

The flaw stems from insufficient bounds checking when the camera's embedded web server processes parameters in a specific web request path.

Vulnerability Overview

Root Cause

The vulnerability exists in the thttpd service — the lightweight HTTP server bundled in GeoVision's LPC camera firmware. When processing a specific web request path, the server fails to validate the length of supplied parameters before copying them into a fixed-size stack buffer. A remote attacker can send a specially crafted HTTP request to overflow this buffer, potentially hijacking the instruction pointer and executing arbitrary code.

Affected Products

GeoVision's LPC (License Plate Capture) series are IP-based surveillance cameras used for automated number plate recognition (ANPR) in parking facilities, access control, and traffic monitoring deployments.

Technical Analysis

Attack Vector

The affected thttpd component listens on the camera's HTTP management interface — typically exposed on port 80 or 8080. The vulnerability is triggered via:

1. An attacker identifies a GeoVision GV-LPC2011 or GV-LPC2211 device exposed to the network (or internet).
2. A crafted HTTP request is sent to a specific request path with an oversized parameter value.
3. The thttpd server copies the parameter into a fixed-size stack buffer without length validation.
4. The stack is overwritten, allowing control of the instruction pointer.
5. With no authentication barrier, the attack is fully pre-authentication.

Why This Is Particularly Dangerous

• No authentication required — attackers do not need any credentials to trigger the overflow.
• Physical security context — LPC cameras are commonly deployed at building entrances, parking gates, and sensitive access control points. Compromise could enable surveillance tampering, gate bypass, or persistent network footholds.
• IoT firmware update challenges — Embedded cameras often run outdated firmware with no automatic update mechanism and are frequently forgotten on network perimeters.

Risk Assessment

Who Is At Risk?

• Organizations using GeoVision LPC cameras for parking facility management
• Physical security and access control deployments
• Any network with internet-exposed GeoVision LPC cameras (port 80/8080)
• Industrial and critical infrastructure sites using ANPR for vehicle access

Potential Impact

A successful exploit could allow an attacker to:

• Execute arbitrary code on the camera (likely as root, given embedded firmware architecture)
• Disable or manipulate camera feeds — tampering with physical security
• Use the device as a pivot point for lateral movement into the corporate network
• Brick the device via uncontrolled memory corruption

Remediation

Immediate Actions

1. Apply firmware updates as soon as GeoVision releases patched firmware (V1.13 or later).
2. Isolate affected cameras on a dedicated VLAN with strict firewall rules — no direct internet exposure.
3. Disable the HTTP management interface if remote web management is not required; use alternative management methods if available.
4. Audit network exposure — use a network scanner to identify any GV-LPC2011/2211 devices accessible from untrusted networks.

Network Mitigations (Until Patched)

Detection

Indicators of Compromise

SIEM/IDS Signatures

Look for HTTP requests to GeoVision camera management interfaces containing abnormally long parameter values in specific request paths — particularly parameters exceeding typical field length expectations.

Key Takeaways

1. CVSS 9.8 Critical — Unauthenticated remote stack overflow with potential for arbitrary code execution.
2. All GV-LPC2011 and GV-LPC2211 cameras on firmware V1.12 or earlier are vulnerable.
3. No authentication required — trivially exploitable by any network-adjacent or internet-based attacker.
4. Physical security implications — Compromise of LPC cameras can undermine access control and surveillance systems.
5. Patch immediately once GeoVision releases updated firmware; apply network mitigations in the interim.

References

• NVD — CVE-2026-57878
• GeoVision Official Website

Related Advisories

• GeoVision LPC Camera ssvr RTSP Auth Buffer Overflow (CVE-2026-57879)
• GeoVision LPC Camera ssvr RTSP Digest Buffer Overflow (CVE-2026-57880)
• GeoVision LPC Camera vlsvr Remote Login Buffer Overflow (CVE-2026-57881)