Geovision Inc.
79 CVEs across 17 Geovision Inc. products. Browse Geovision Inc. vulnerabilities, severities, and proof-of-concept exploits.
Geovision Inc. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-103096 | High | 7.5 | 2026-10-02 | API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials di… |
CVE-2026-92838 | High | 7.8 | 2026-09-17 | A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from… |
CVE-2026-88290 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing… |
CVE-2026-88289 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple… |
CVE-2026-88288 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary f… |
CVE-2026-88287 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corru… |
CVE-2026-88286 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conn… |
CVE-2026-88285 | Critical | 9.4 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and iss… |
CVE-2026-88284 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control… |
CVE-2026-88283 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack cont… |
CVE-2026-88282 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a s… |
CVE-2026-88281 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack… |
CVE-2026-88280 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF work… |
CVE-2026-88279 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to c… |
CVE-2026-88278 | Critical | 9.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be repla… |
CVE-2026-88277 | High | 8.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. |
CVE-2026-88276 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. |
CVE-2026-88275 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration… |
CVE-2026-88274 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. |
CVE-2026-88273 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands… |
CVE-2026-88272 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the store… |
CVE-2026-88271 | High | 8.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. |
CVE-2026-88270 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
CVE-2026-88269 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSV… |
CVE-2026-88268 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. |
CVE-2026-18755 | High | 7.3 | 2026-08-04 | A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By p… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-16519 | High | 7.3 | 2026-07-24 | A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs)… |
CVE-2026-57278 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57277 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57276 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57275 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57274 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57273 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57272 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57271 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57270 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57269 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57268 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57267 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57266 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57265 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57264 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13132 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13131 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13125 | High | 8.8 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57881 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-57880 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57879 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57878 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is ca… |
CVE-2026-57877 | High | 8.6 | 2026-06-26 | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by imprope… |
CVE-2026-57876 | High | 7.5 | 2026-06-26 | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused… |
CVE-2026-57875 | High | 7.5 | 2026-06-26 | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LP… |
CVE-2026-57874 | High | 7.5 | 2026-06-26 | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is… |
CVE-2026-57873 | High | 7.5 | 2026-06-26 | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerab… |
CVE-2026-57872 | High | 7.5 | 2026-06-26 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-12851 | Critical | 9.1 | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet ca… |
CVE-2026-12850 | Critical | 9.1 | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet ca… |
CVE-2026-12849 | Critical | 9.1 | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet ca… |
CVE-2026-12848 | Critical | 10.0 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by d… |
CVE-2026-12847 | Critical | 10.0 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by d… |
CVE-2026-12846 | Critical | 10.0 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by d… |
CVE-2026-12488 | Medium | 6.2 | 2026-06-24 | A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted network request can lead to a den… |
CVE-2026-12486 | Critical | 9.1 | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet ca… |
CVE-2026-12485 | Critical | 10.0 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by d… |
CVE-2026-7841 | High | 8.8 | 2026-05-06 | A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can ex… |
CVE-2026-7372 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-7371 | High | 7.4 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially… |
CVE-2026-7161 | Critical | 9.3 | 2026-05-04 | An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast pack… |
CVE-2026-42370 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-42369 | Critical | 10.0 | 2026-05-04 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application a… |
CVE-2026-42368 | Critical | 9.9 | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to… |
CVE-2026-42367 | Medium | 6.5 | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request ca… |
CVE-2026-42366 | High | 7.4 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially… |
CVE-2026-42365 | High | 8.6 | 2026-05-04 | A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP reques… |
CVE-2026-42364 | Critical | 9.9 | 2026-05-04 | An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can… |
CVE-2026-42363 | Critical | 9.3 | 2026-04-27 | An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast pack… |
CVE-2018-25118 | | 2025-10-20 | GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an at… |