CVE-2026-88288: GeoVision Inc Gv-LPC2011/LPC2211

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.

Affected products

Published 2026-09-10. Last modified 2026-09-10.