## Summary
GeoVision GV-LPC2011 and GV-LPC2211 (V1.12 and earlier) contain an unauthenticated NULL pointer dereference in HTTP request parsing across multiple CGI components. A remote attacker can send a crafted HTTP request to crash the affected process, causing a denial of service.
## Technical Details
- Root cause: improper validation of required HTTP request metadata before it is used by the affected CGI components.
- Vulnerability type: CWE-476 (NULL Pointer Dereference).
- Attack condition: no authentication required (PR:N).
- Exploit behavior: a specially crafted HTTP request triggers the NULL dereference, leading to a process crash.
- Result: denial of service (A:H), with no stated impact to confidentiality or integrity.
## Affected
- GeoVision GV-LPC2011 — V1.12 and earlier
- GeoVision GV-LPC2211 — V1.12 and earlier
## Impact
- Unauthenticated remote crash of HTTP/CGI handling logic.
- Availability impact: high likelihood of service disruption due to process termination (CVSS 7.5, A:H).
## Mitigation
1. Update to the latest GeoVision software/firmware release for the affected products (GeoVision notes that security patches are included in the latest supported releases).
2. If immediate patching is not possible, restrict network access to the device’s HTTP/CGI interfaces (reduce exposure to unauthenticated requests).
3. Monitor for repeated abnormal HTTP requests that correlate with service crashes and validate device uptime/health after changes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476