This vulnerability involves multiple reflected XSS issues in the ssi.cgi component of GeoVision GV-LPC2011/LPC2211 firmware version 1.10. An attacker can craft a malicious URL that, when visited by a user, causes the web interface to reflect the input unsafely in an error message, enabling execution of arbitrary JavaScript code in the victim's browser context. The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and high confidentiality impact but no integrity or availability impact. There is no known exploit in the wild and no vendor-provided patch or mitigation at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the affected device's web interface for users who visit a maliciously crafted URL. This can lead to theft of sensitive information accessible via the browser session, such as authentication tokens or other confidential data. The vulnerability does not impact system integrity or availability directly. The attack requires user interaction and network access to the device's web interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid accessing untrusted URLs that interact with the affected device's web interface. Network-level protections such as web application firewalls might help reduce exposure. Monitor vendor communications for updates on patches or official mitigations.