This vulnerability (CWE-134) exists in the vlsvr service of GeoVision GV-LPC2011 and GV-LPC2211 devices at version 1.12 and earlier. It is caused by improper sanitization of externally controlled input used in format strings during login processing, allowing an unauthenticated remote attacker to send specially crafted login data. Exploitation may result in information disclosure, memory corruption, or denial of service conditions. The CVSS 3.1 base score is 8.6, reflecting high severity with network attack vector, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation can lead to information disclosure, memory corruption, or denial of service on affected devices. The vulnerability is exploitable remotely without authentication, increasing risk. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for suspicious login attempts. Avoid exposing the vulnerable devices directly to untrusted networks.