This vulnerability (CVE-2026-42367) in GeoVision GV-LPC2011/LPC2211 version 1.10 arises from insufficient protection of credentials within the web interface component ssi.cgi. Exploitation involves an attacker sending a crafted HTTP request that triggers leakage of sensitive credential information, enabling privilege escalation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently provided.

Successful exploitation can lead to credential leakage, which may allow an attacker with some privileges to escalate their access. This compromises confidentiality of sensitive information but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit network exposure of the affected devices and restrict access to trusted users only. Monitor for unusual access patterns related to the web interface.