Security readout for executives and security teams
Plain-English summary
CVE-2026-42367 affects GeoVision GV-LPC2011/LPC2211 web management interfaces. A logged-in, low-privileged attacker can trigger a flaw that leaks Administrator credentials. That can turn limited access into device control, so exposed management interfaces and shared low-privilege accounts create the main business risk.
Executive priority
Treat this as a focused remediation item for exposed or shared-access device management networks. It is not listed as actively exploited in the provided sources, but Administrator credential leakage can quickly change business impact if access controls are weak.
Technical view
The issue is a CWE-522 credential exposure in the Web Interface / ssi.cgi functionality. The source bundle lists GV-LPC2011/LPC2211 versions V1.10 and V1.20 as affected. CVSS 3.1 is 6.5: network-accessible, low complexity, low privileges required, no user interaction, high confidentiality impact, no integrity or availability impact scored.
Likely exposure
Exposure is most likely where GeoVision GV-LPC2011/LPC2211 devices run V1.10 or V1.20 and their web interface is reachable by non-admin users or broader internal networks.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation. Publicly provided details indicate a specially crafted HTTP request can leak Administrator credentials, but no exploit procedure, indicators, or real-world campaign evidence is included.
Researcher notes
The key constraint is PR:L: validation should focus on authenticated exposure and credential-handling behavior without disclosing or reproducing exploit mechanics. Source evidence is sufficient for affected product, versions, CVSS, CWE, and advisory references, but incomplete for patch version and exploitation telemetry.
Mitigation direction
- Review GeoVision's advisory for fixed firmware or official mitigation guidance.
- Upgrade affected GV-LPC2011/LPC2211 firmware when vendor guidance identifies a safe version.
- Restrict the web interface to trusted administration networks only.
- Remove unnecessary low-privilege accounts and rotate Administrator credentials after remediation.
- Monitor device access logs for unusual authenticated web-interface activity.
Validation and detection
- Inventory GeoVision GV-LPC2011/LPC2211 devices and record firmware versions.
- Confirm whether V1.10 or V1.20 is present in production.
- Verify web management access is blocked from untrusted networks.
- Check whether low-privilege accounts exist and are still needed.
- Confirm remediation status against GeoVision and Talos advisories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-42367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6GVVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineGV
Initial Vendor Contact
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.geovision.com.tw/cyber_security.phpCVE reference, GV · vendor-advisory
- https://talosintelligence.com/vulnerability_reports/CVE reference, GV · third-party-advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2328CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.