Replay Attack Vulnerability in GeoVision GV-LPC2211 Product
CVE-2026-88278

9.8CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-lpclpc2011/2211
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88278?

The GeoVision GV-LPC2211 V1.13 is vulnerable to replay attacks due to inadequate enforcement of WS-Security UsernameToken freshness and nonce reuse protection. This weakness could allow an adversary to capture the PasswordDigest token and maliciously replay it during subsequent ONVIF operations, posing a significant security risk for users of the device.

Affected Version(s)

GV-LPCLPC2011/2211 1.13

GV-LPCLPC2011/2211 1.14

References

https://www.geovision.com.tw/cyber_security.php

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University
.