CVE-2026-88278

GeoVision GV-LPC2211 license-plate-capture cameras running firmware V1.13 do not enforce freshness or nonce-reuse checks on WS-Security UsernameToken credentials used for ONVIF requests. An attacker who can observe network traffic, for example by sniffing the camera's network segment, can capture a PasswordDigest token and replay it unchanged, and the camera will accept it for subsequent ONVIF operations. Because the replayed token is treated as valid, the attacker effectively authenticates as the ONVIF user without knowing the password, gaining access to ONVIF operations such as retrieving video streams and viewing or changing camera settings; the CVSS score reflects potentially high confidentiality and integrity impact, though the flaw is in authentication rather than code execution. Any deployment of the GV-LPC2211 on firmware V1.13 that uses WS-Security UsernameToken authentication over ONVIF is exposed, particularly where ONVIF traffic traverses a network an attacker can observe. As of now there are no public proofs of concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade the GV-LPC2211 to firmware newer than V1.13 as soon as GeoVision publishes a fix; the advisory names only V1.13, so administrators should check current firmware listings to confirm the fixed version. Until patched, restrict network access to the camera's ONVIF endpoint (management VLAN or firewall rules), use HTTPS for ONVIF traffic so captured digest tokens are harder to obtain, and monitor authentication logs for repeated logins using identical tokens or nonces, which indicates replay attempts.