This vulnerability (CVE-2026-42365) affects the web interface of GeoVision GV-LPC2011/LPC2211 version 1.10. The issue is a predictable session cookie (CWE-341) that can be brute forced by an attacker through a series of crafted HTTP requests, resulting in authentication bypass. The CVSS v3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. The vendor has not provided a patch or remediation level, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and gain unauthorized access to the device's web interface. This can lead to full confidentiality compromise of the device's data accessible via the web interface. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device's web interface to trusted users only and monitor for unusual access patterns. Avoid exposing the device's web interface directly to untrusted networks.