# CVE-2026-42367: GeoVision LPC2011/LPC2211 privilege escalation in ssi.cgi

Source: https://junglewise.ai/threats/cve-2026-42367-geovision-lpc2011-lpc2211-privilege-escalation-in-ssi-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-42367 · Severity: medium · CVSS 6.5 · Published 2026-05-04

A security vulnerability in GeoVision license plate recognition cameras allows users with low-level 'Guest' access to obtain the login credentials of the system administrator. By sending a specific request to the camera's web interface, an attacker can view sensitive configuration data that includes the administrator's username and password. This could lead to a full takeover of the device, allowing unauthorized parties to change camera settings, view private feeds, or disable security monitoring.

Technologies: [Geovision Gv-Lpc2011](https://junglewise.ai/threats/technologies/gv-lpc2011), [Geovision Gv-Lpc2011 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2011-firmware), [Geovision Gv-Lpc2211](https://junglewise.ai/threats/technologies/gv-lpc2211), [Geovision Gv-Lpc2211 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2211-firmware), [Geovision LPC2011 Firmware](https://junglewise.ai/threats/technologies/lpc2011-firmware), [Geovision LPC2211 Firmware](https://junglewise.ai/threats/technologies/lpc2211-firmware). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-42367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42367 being exploited in the wild.

**How severe is CVE-2026-42367?** Medium severity, with a CVSS score of 6.5, published 4 May 2026.

**Which products and versions are affected?** Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.

**Is there a fix for CVE-2026-42367?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42367 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42367?** Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the ssi.cgi functionality of GeoVision LPC2011/LPC2211 firmware version 1.10. The ssi.cgi endpoint implements a server-side template mechanism that is accessible to users with 'Guest' privileges. Specifically, the /ssi.cgi/UserSetting.htm page includes the 'USER_CFG' tag, which triggers the server to output the administrator's username and password as encrypted blobs within the page's JavaScript. However, because the server also provides the decryption key in the same response, a Guest user can decrypt these values to obtain plaintext administrator credentials. This is classified as CWE-522 (Insufficiently Protected Credentials). An attacker requires network access and low-level authentication to exploit this flaw.

## Affected products

- GeoVision LPC2011 firmware 1.10
- GeoVision LPC2211 firmware 1.10

## Timeline

- 2026-04-27: advisory: Vendor advisory published by GeoVision
- 2026-05-04: disclosed: NVD publication date
- 2026-06-15: advisory: Detailed Talos intelligence report released

## References

- [https://talosintelligence.com/vulnerability_reports/](https://talosintelligence.com/vulnerability_reports/)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2328](https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2328)

## Related threats

- [GeoVision GV-LPC2211 unbounded frame length denial of service](https://junglewise.ai/threats/cve-2026-88290-geovision-gv-lpc2211-unbounded-frame-length-denial-of-service)
- [GeoVision GV-LPC2211 stack buffer overflow in VLSVR request handlers](https://junglewise.ai/threats/cve-2026-88289-geovision-gv-lpc2211-stack-buffer-overflow-in-vlsvr-request)
- [GeoVision GV-LPC2211 path traversal in BKDownloadLink.cgi](https://junglewise.ai/threats/cve-2026-88288-geovision-gv-lpc2211-path-traversal-in-bkdownloadlink-cgi)
- [GeoVision GV-LPC2211 stack overflow in ONVIF WS-Discovery](https://junglewise.ai/threats/cve-2026-88287-geovision-gv-lpc2211-stack-overflow-in-onvif-ws-discovery)
- [GeoVision GV-LPC2211 PTZ connection state denial of service](https://junglewise.ai/threats/cve-2026-88286-geovision-gv-lpc2211-ptz-connection-state-denial-of-service)