CVE-2026-57878: GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)

Synopsis

A stack-based buffer overflow exists in the thttpd web server component of GeoVision GV-LPC2011 and GV-LPC2211 devices running firmware V1.12 and earlier. The vulnerability is reachable over the network with no authentication required, triggered by sending a crafted HTTP request with an overly long parameter to a specific request path. Successful exploitation causes memory corruption that enables denial of service or arbitrary code execution on the affected device. A patched-image rebuild at firmware version 1.13 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's thttpd web server over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials of any kind are required; the exploit works against the unauthenticated HTTP interface.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly; no user on the target device needs to take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sends an oversized HTTP parameter with no need to win a race or satisfy environmental prerequisites.

Blast Radius

• The attacker achieves arbitrary code execution on the affected device, gaining full control over its runtime environment.
• All data stored or processed by the device is readable by the attacker, including configuration, credentials, and captured media.
• The attacker can modify persisted configuration and firmware state on the device.
• The device process can be crashed at will, causing a denial of service and taking the device offline.