This vulnerability involves multiple reflected XSS issues in the ssi.cgi component of GeoVision GV-LPC2011/LPC2211 version 1.10. An attacker can craft a malicious URL that, when visited by a user, causes the web interface to reflect unsanitized input in error messages, enabling arbitrary JavaScript execution in the context of the victim's browser session. The CVSS 3.1 score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, and high confidentiality impact without integrity or availability impact. No official patch or remediation level has been published by the vendor as of now.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser when they visit a crafted URL. This can lead to theft of sensitive information accessible to the browser, such as session tokens or other confidential data. The vulnerability does not impact system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted or suspicious URLs targeting the affected web interface. Network-level protections such as web application firewalls may help detect and block malicious requests exploiting this reflected XSS vulnerability.