An unauthenticated directory traversal vulnerability exists in the get_fcont.cgi CGI component of GeoVision GV-LPCLPC2011 and GV-LPCLPC2211 devices running version 1.12 and earlier. The vulnerability arises from improper validation of file path input, enabling remote attackers to craft requests that access arbitrary files accessible to the affected process. This results in unauthorized information disclosure. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows remote attackers to read arbitrary files on the affected device, potentially exposing sensitive information. There is no impact on integrity or availability reported. The vulnerability does not require authentication or user interaction, increasing its risk.

No official patch or remediation has been published by the vendor as of the information provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected devices and monitor for suspicious requests targeting get_fcont.cgi.