CVE-2026-42368 GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability
An attacker can execute privileged operations on GeoVision LPC2011/LPC2211 devices by sending a specially crafted HTTP request, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42368?
CVE-2026-42368 is a critical vulnerability in GeoVision Inc. GV-LPC2011/LPC2211, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.
Weakness: CWE-266
Which versions are affected by CVE-2026-42368?
It affects 2 products.
Products include Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 Firmware.
How do I fix CVE-2026-42368?
No fix has been published for CVE-2026-42368 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-42368 being exploited?
There is no known exploitation of CVE-2026-42368 in the wild and no public exploit code.
Other vulnerabilities in GeoVision Inc. GV-LPC2011/LPC2211
- CVE-2026-42364 GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability
- CVE-2026-42365 GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability
- CVE-2026-42366 GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities
- CVE-2026-7371 GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities
- CVE-2026-42367 Information disclosure in GV-LPC2011/LPC2211
Sources
Also known as GHSA-gh3w-5fjx-5f7x.