# CVE-2026-42368: GeoVision LPC2011/LPC2211 privilege escalation in web interface

Source: https://junglewise.ai/threats/cve-2026-42368-geovision-lpc2011-lpc2211-privilege-escalation-in-web-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-42368 · Severity: critical · CVSS 9.9 · Published 2026-05-04

A privilege escalation vulnerability exists in the web interface of GeoVision LPC2011 and LPC2211 license plate recognition cameras. These devices are used for automated vehicle identification and security monitoring. An attacker with low-level guest access can exploit this flaw to perform administrative actions, such as rebooting the device, modifying system settings, or stealing administrator credentials, potentially leading to a full takeover of the camera system.

Technologies: [Geovision Gv-Lpc2011](https://junglewise.ai/threats/technologies/gv-lpc2011), [Geovision Gv-Lpc2011 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2011-firmware), [Geovision Gv-Lpc2211](https://junglewise.ai/threats/technologies/gv-lpc2211), [Geovision Gv-Lpc2211 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2211-firmware), [Geovision LPC2011 Firmware](https://junglewise.ai/threats/technologies/lpc2011-firmware), [Geovision LPC2211 Firmware](https://junglewise.ai/threats/technologies/lpc2211-firmware). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-42368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42368 being exploited in the wild.

**How severe is CVE-2026-42368?** Critical severity, with a CVSS score of 9.9, published 4 May 2026.

**Which products and versions are affected?** Geovision LPC2011 Firmware 1.10; Geovision LPC2211 Firmware 1.10.

**Is there a fix for CVE-2026-42368?** A patch was published on 2026-04-14: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42368 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-42368?** Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the web interface of GeoVision LPC2011 and LPC2211 firmware version 1.10 due to incorrect privilege assignment (CWE-266). The root cause is a failure in the '/geo-cgi/' path handlers to verify user authorization levels; the system only checks for a valid session cookie without distinguishing between Guest and Administrator roles. A remote attacker with low-privileged 'Guest' credentials can send specially crafted HTTP requests to sensitive endpoints like 'geo-cgi/params.cgi' to retrieve the system shadow file or export the full configuration containing plaintext credentials. This allows for full administrative takeover, firmware tampering, or device disruption. A patch was released by the vendor in April 2026.

## Affected products

- GeoVision LPC2011 Firmware 1.10
- GeoVision LPC2211 Firmware 1.10

## Timeline

- 2026-02-17: other: Initial vendor contact
- 2026-02-24: disclosed: Vendor disclosure
- 2026-04-14: patched: Vendor patch release
- 2026-05-04: advisory: NVD publication date
- 2026-06-15: disclosed: Public release by Cisco Talos

## References

- [https://https//talosintelligence.com/vulnerability_reports/](https://https//talosintelligence.com/vulnerability_reports/)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2329](https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2329)

## Related threats

- [GeoVision GV-LPC2211 unbounded frame length denial of service](https://junglewise.ai/threats/cve-2026-88290-geovision-gv-lpc2211-unbounded-frame-length-denial-of-service)
- [GeoVision GV-LPC2211 stack buffer overflow in VLSVR request handlers](https://junglewise.ai/threats/cve-2026-88289-geovision-gv-lpc2211-stack-buffer-overflow-in-vlsvr-request)
- [GeoVision GV-LPC2211 path traversal in BKDownloadLink.cgi](https://junglewise.ai/threats/cve-2026-88288-geovision-gv-lpc2211-path-traversal-in-bkdownloadlink-cgi)
- [GeoVision GV-LPC2211 stack overflow in ONVIF WS-Discovery](https://junglewise.ai/threats/cve-2026-88287-geovision-gv-lpc2211-stack-overflow-in-onvif-ws-discovery)
- [GeoVision GV-LPC2211 PTZ connection state denial of service](https://junglewise.ai/threats/cve-2026-88286-geovision-gv-lpc2211-ptz-connection-state-denial-of-service)