Executive brief
A security vulnerability in GeoVision license plate recognition cameras allows users with low-level 'Guest' access to obtain the login credentials of the system administrator. By sending a specific request to the camera's web interface, an attacker can view sensitive configuration data that includes the administrator's username and password. This could lead to a full takeover of the device, allowing unauthorized parties to change camera settings, view private feeds, or disable security monitoring.
Technical details
A privilege escalation vulnerability exists in the ssi.cgi functionality of GeoVision LPC2011/LPC2211 firmware version 1.10. The ssi.cgi endpoint implements a server-side template mechanism that is accessible to users with 'Guest' privileges. Specifically, the /ssi.cgi/UserSetting.htm page includes the 'USER_CFG' tag, which triggers the server to output the administrator's username and password as encrypted blobs within the page's JavaScript. However, because the server also provides the decryption key in the same response, a Guest user can decrypt these values to obtain plaintext administrator credentials. This is classified as CWE-522 (Insufficiently Protected Credentials). An attacker requires network access and low-level authentication to exploit this flaw.
Affected products
- GeoVision LPC2011 firmware 1.10
- GeoVision LPC2211 firmware 1.10
Timeline
- 2026-04-27: advisory: Vendor advisory published by GeoVision
- 2026-05-04: disclosed: NVD publication date
- 2026-06-15: advisory: Detailed Talos intelligence report released