This vulnerability involves multiple reflected cross-site scripting (CWE-79) issues in the ssi.cgi component of GeoVision GV-LPC2011/LPC2211 version 1.10. An attacker can craft a malicious URL that, when visited by a user, causes arbitrary JavaScript code execution within the victim's browser session. The vulnerability is remotely exploitable without authentication (AV:N/AC:L/PR:N/UI:R) and affects confidentiality (C:H) but not integrity or availability. The vulnerability has been assigned CVSS v3.1 base score 7.4, indicating high severity. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to theft of sensitive information accessible via the browser session. The impact is limited to confidentiality compromise; integrity and availability are not affected. Since this is a reflected XSS, exploitation requires user interaction (clicking a crafted URL). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted or suspicious URLs targeting the affected device's web interface. Network-level protections such as web application firewalls may help detect and block malicious requests exploiting this vulnerability. Monitor vendor channels for updates regarding patches or official mitigations.