This vulnerability (CWE-121) exists due to insufficient length validation of remote login data in the vlsvr service of GeoVision GV-LPC2011 and GV-LPC2211 devices. An unauthenticated attacker can exploit this by sending crafted input that overflows the stack buffer, potentially resulting in memory corruption, denial of service, or remote code execution. The affected versions are 1.12 and earlier. No official patch or remediation level has been published yet, and no known exploits are reported in the wild as of the publication date.

Successful exploitation can lead to complete compromise of the affected device, including arbitrary code execution with no privileges required and no user interaction. This can cause denial of service or allow an attacker to take full control of the device remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable service to trusted sources only and monitor for suspicious login attempts.