CVE-2026-57872: GeoVision IP Camera Unauthenticated Directory Traversal

Technical summary

CVE-2026-57872 is an unauthenticated directory traversal vulnerability (CWE-22) in the get_fcont.cgi CGI component of GeoVision GV-LPC2011 and GV-LPC2211 devices running firmware V1.12 and earlier. The vulnerability stems from insufficient input validation on file path parameters, allowing attackers to traverse directory structures and read arbitrary files accessible to the web server process. The CVSS 3.1 score of 7.5 (HIGH) reflects the high confidentiality impact with network-accessible attack surface and no privileges or user interaction required.

Business impact

Compromise of GeoVision IP camera devices can expose sensitive operational data including administrator credentials, network configuration details, and potentially access credentials to connected systems or storage infrastructure. Organizations deploying these devices for surveillance may face data loss, unauthorized system access downstream, and compliance violations if personally identifiable information (PII) or security-sensitive configurations are exfiltrated. The lack of authentication requirements significantly lowers the barrier to exploitation.

Affected systems

GeoVision GV-LPC2011 and GV-LPC2211 IP cameras running firmware version V1.12 and earlier are vulnerable. Organizations should audit their inventory for these specific models and confirm current firmware versions. GeoVision may have released updated firmware; consult vendor advisories for patched versions and compatibility guidance.

Exploitability

This vulnerability has a low bar to exploitation. No authentication is required, and standard HTTP requests with path traversal payloads (e.g., '../../etc/passwd') can be crafted by any network-adjacent attacker. The attack vector is network-based, does not require user interaction, and succeeds against default or weak configurations. However, exploitation depends on the attacker knowing or discovering affected devices on the network, and on file permissions within the camera's operating system.

Remediation

The primary remediation is to upgrade affected GeoVision devices to a patched firmware version released by GeoVision that addresses directory traversal validation. Organizations should verify the latest available firmware for GV-LPC2011 and GV-LPC2211 models. As interim mitigations, restrict network access to the camera's web interface using firewall rules, network segmentation, or VPN requirements; disable or isolate the get_fcont.cgi component if possible through vendor configuration options; and regularly audit device logs for suspicious file access patterns.

Patch guidance

Consult GeoVision's official security advisory and product support portal for firmware updates addressing this vulnerability. Firmware versions prior to V1.12 are confirmed vulnerable; verify against GeoVision's advisory documentation for the exact patched version number. Test patches in a controlled environment before production deployment, as firmware updates on IP cameras may require brief service interruption. Maintain backups of device configurations before upgrading.

Detection guidance

Monitor web server logs on affected cameras for HTTP requests containing path traversal sequences ('../', '..\', percent-encoded variants like '%2e%2e%2f'). Watch for repeated requests to get_fcont.cgi with unusual file path parameters. Implement network-based detection rules for directory traversal attempts targeting the affected CGI script. Review access logs for successful reads of sensitive files like configuration, password, or system files. Conduct regular vulnerability scans of your camera inventory using authenticated and unauthenticated scan profiles.

Why prioritize this

This vulnerability warrants high priority remediation because it enables unauthenticated information disclosure with a HIGH CVSS score (7.5), requires no user interaction, and can directly expose credentials and sensitive configuration data that may be leveraged for further lateral movement or system compromise. Organizations with GeoVision cameras in internet-facing or less-controlled network segments face elevated risk and should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity rating driven by network accessibility (AV:N), no authentication required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H). The lack of integrity and availability impact (I:N/A:N) prevents a critical rating, but the combination of ease of exploitation and sensitive data exposure justifies urgent remediation.

Frequently asked questions