Is CVE-2026-42368 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42368 being exploited in the wild.

How severe is CVE-2026-42368?

Critical severity, with a CVSS score of 9.9, published 4 May 2026.

Which products and versions are affected?

Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.

Is there a fix for CVE-2026-42368?

A patch was published on 2026-04-14: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42368 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-42368?

Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42368: GeoVision LPC2011/LPC2211 privilege escalation in web interface

CVE-2026-42368 · Severity: critical · CVSS 9.9 · Published 2026-05-04

A privilege escalation vulnerability exists in the web interface of GeoVision LPC2011 and LPC2211 license plate recognition cameras. These devices are used for automated vehicle identification and security monitoring. An attacker with low-level guest access can exploit this flaw to perform administrative actions, such as rebooting the device, modifying system settings, or stealing administrator credentials, potentially leading to a full takeover of the camera system.

Technologies: Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211, Geovision Gv-Lpc2211 Firmware, Geovision LPC2011 Firmware, Geovision LPC2211 Firmware. Vendors: Geovision.

Quick answers

Is CVE-2026-42368 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42368 being exploited in the wild.
How severe is CVE-2026-42368?: Critical severity, with a CVSS score of 9.9, published 4 May 2026.
Which products and versions are affected?: Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.
Is there a fix for CVE-2026-42368?: A patch was published on 2026-04-14: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42368 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-42368?: Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the web interface of GeoVision LPC2011 and LPC2211 firmware version 1.10 due to incorrect privilege assignment (CWE-266). The root cause is a failure in the '/geo-cgi/' path handlers to verify user authorization levels; the system only checks for a valid session cookie without distinguishing between Guest and Administrator roles. A remote attacker with low-privileged 'Guest' credentials can send specially crafted HTTP requests to sensitive endpoints like 'geo-cgi/params.cgi' to retrieve the system shadow file or export the full configuration containing plaintext credentials. This allows for full administrative takeover, firmware tampering, or device disruption. A patch was released by the vendor in April 2026.

Affected products

GeoVision LPC2011 Firmware 1.10
GeoVision LPC2211 Firmware 1.10

Timeline

2026-02-17: other: Initial vendor contact
2026-02-24: disclosed: Vendor disclosure
2026-04-14: patched: Vendor patch release
2026-05-04: advisory: NVD publication date
2026-06-15: disclosed: Public release by Cisco Talos

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.