GeoVision GV-LPC2211 V1.13 contains a stack-based buffer overflow (CWE-121) triggered by copying oversized ONVIF CreateUsers username or password values into fixed-size stack buffers. An authenticated administrator can exploit this to crash the ONVIF worker process, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation allows an authenticated administrator to cause a denial of service by crashing the ONVIF worker process. There is no impact on confidentiality or integrity reported. The service disruption could affect availability of the ONVIF interface on the device.

No official patch or remediation is currently available. Since exploitation requires authenticated administrator access, limiting administrative access and monitoring for unusual administrator activity may reduce risk. Check the vendor advisory regularly for updates on patches or mitigations.