Is CVE-2026-42365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42365 being exploited in the wild.

How severe is CVE-2026-42365?

High severity, with a CVSS score of 8.6, published 4 May 2026.

Which products and versions are affected?

Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.

Is there a fix for CVE-2026-42365?

A patch was published on 2026-04-14: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42365 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-42365?

Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42365: GeoVision LPC2011/LPC2211 guessable session cookie in Web Interface

CVE-2026-42365 · Severity: high · CVSS 8.6 · Published 2026-05-04

A vulnerability in GeoVision license plate recognition cameras allows unauthorized individuals to bypass security controls and gain administrative access. The cameras use predictable session identifiers that can be guessed or discovered through automated trial-and-error. An attacker who successfully exploits this can take full control of the device's web management interface, potentially viewing camera feeds or altering security settings.

Technologies: Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211, Geovision Gv-Lpc2211 Firmware, Geovision LPC2011 Firmware, Geovision LPC2211 Firmware. Vendors: Geovision.

Quick answers

Is CVE-2026-42365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42365 being exploited in the wild.
How severe is CVE-2026-42365?: High severity, with a CVSS score of 8.6, published 4 May 2026.
Which products and versions are affected?: Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.
Is there a fix for CVE-2026-42365?: A patch was published on 2026-04-14: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42365 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-42365?: Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A predictable session cookie vulnerability exists in the web interface of GeoVision LPC2011/LPC2211 firmware version 1.10. The root cause is the use of insufficient entropy in the Client ID generation functions (SIuUTIL_WebNewAdmId and SIuUTIL_WebNewGstId). Specifically, the pseudo-random number generator is seeded with the current system time and the resulting value is truncated to a range of only 100,000 possible values. Furthermore, the session validation function (SIuUTIL_WebLoginIsAdmin) fails to verify the remote IP address associated with the Client ID. A remote, unauthenticated attacker can use a series of HTTP requests to brute-force active session cookies and perform privileged operations.

Affected products

GeoVision LPC2011 Firmware 1.10
GeoVision LPC2211 Firmware 1.10

Timeline

2026-02-17: other: Initial vendor contact
2026-02-24: disclosed: Vendor disclosure
2026-04-14: patched: Vendor patch release
2026-05-04: advisory: NVD publication date
2026-06-15: other: Public release by Cisco Talos

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.