This vulnerability (CVE-2026-42367) affects GeoVision GV-LPC2011/LPC2211 version 1.10. The issue lies in the ssi.cgi functionality of the device's web interface, where insufficient protection of credentials allows a specially crafted HTTP request to leak sensitive credential information. This can lead to privilege escalation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required low privileges, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation results in leakage of credentials, enabling an attacker with low privileges to escalate their privileges on the affected device. Confidentiality is severely impacted, but integrity and availability remain unaffected. This could allow unauthorized access to sensitive functions or data within the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's web interface to trusted users only and monitor for suspicious HTTP requests targeting ssi.cgi. Avoid exposing the device directly to untrusted networks.