GeoVision vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited GeoVision flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2024-11120 GeoVision Devices OS Command InjectionExploited since May 7, 2025 · CVSS 9.8
• CVE-2024-6047 GeoVision Devices OS Command InjectionExploited since May 7, 2025 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-108984 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .High 7.5 · Oct 18, 2026
• CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .Critical 9.8 · Oct 18, 2026
• CVE-2026-103098 Transmission of a sensitive key in the URL over an unencrypted HTTP connection.High 7.5 · Oct 1, 2026
• CVE-2026-103097 An API key is hardcoded and retrievable from the application package.High 7.5 · Oct 1, 2026
• CVE-2026-103096 API key is hardcoded and retrievable from the application package.High 7.5 · Oct 1, 2026
• CVE-2026-92838 A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application.High 7.8 · Sep 16, 2026
• CVE-2026-88290 GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing rHigh 7.5 · Sep 10, 2026
• CVE-2026-88289 GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VHigh 7.5 · Sep 10, 2026
• CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupHigh 7.5 · Sep 10, 2026
• CVE-2026-88286 GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conneHigh 7.5 · Sep 10, 2026
• CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issuCritical 9.4 · Sep 10, 2026
• CVE-2026-88282 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a suHigh 7.2 · Sep 10, 2026
• CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayCritical 9.8 · Sep 10, 2026
• CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.High 8.8 · Sep 10, 2026
• CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.High 7.2 · Sep 10, 2026
• CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration High 7.2 · Sep 10, 2026
• CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.High 7.2 · Sep 10, 2026
• CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands aHigh 7.2 · Sep 10, 2026
• CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the storedHigh 7.2 · Sep 10, 2026
• CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.High 8.8 · Sep 10, 2026
• CVE-2026-18755 A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code.High 7.3 · Aug 4, 2026
• CVE-2026-18754 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination.Critical 9.1 · Aug 4, 2026
• CVE-2026-18753 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination.Critical 9.1 · Aug 4, 2026
• CVE-2026-16519 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application.High 7.3 · Jul 24, 2026
• CVE-2026-57278 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision softwHigh 8.3 · Jul 2, 2026