The vulnerability identified as CVE-2026-88269 affects GeoVision GV-LPC2011/LPC2211 devices running version 1.13. A Guest user can access persistent device configuration containing plaintext credentials without proper authorization checks through the SSVR interface. This represents a missing authorization control (CWE-862) that exposes sensitive credential information. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction, and resulting in high confidentiality impact without affecting integrity or availability.

An attacker with Guest user access can retrieve plaintext administrative and user credentials from the device configuration. This compromises confidentiality of sensitive credentials, potentially allowing further unauthorized access or lateral movement. There is no direct impact on integrity or availability reported.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict Guest user access to the affected devices and monitor for unauthorized access attempts.