CVE-2026-57880: GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)

Synopsis

A stack-based buffer overflow exists in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 firmware versions 1.12 and earlier. The flaw is triggered when the device parses the username field in an RTSP Digest authentication request, and no credentials are required to reach it over the network. Successful exploitation can corrupt memory and give an attacker full control of the device, including arbitrary code execution. A patched-image rebuild at firmware version 1.13 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's RTSP service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable code path is hit before any authentication check completes.

• Victim interactionNot required

  The attacker sends a single crafted RTSP request with no action required from any user on the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, specific memory layout, or environmental prerequisites are required.

Blast Radius

• An attacker gains the ability to execute arbitrary code in the context of the ssvr process, with whatever privileges that process holds on the device.
• Memory corruption from the overflow can crash the ssvr service, taking RTSP streaming and associated device functions offline.
• A successful code-execution payload grants read access to files and credentials stored on the device, including any configured network or access-control data.
• An attacker with code execution can modify device configuration, disable logging, or pivot to adjacent network segments the device is connected to.