CVE-2026-88278
Received Received - Intake

WS-Security Token Replay in GeoVision GV-LPC2211

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GV

Description
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88278
EUVD
EUVD-2026-75312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geovision gv-lpc2211 1.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GeoVision GV-LPC2211 V1.13 does not properly enforce freshness checks for WS-Security UsernameToken or prevent nonce reuse. This allows an attacker to capture a PasswordDigest token and replay it to perform unauthorized ONVIF operations.

Impact Analysis

An attacker could gain unauthorized access to ONVIF operations, potentially viewing or manipulating video feeds, changing device settings, or disabling security features without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to inadequate security controls for protecting personal or health information.

Mitigation Strategies

Update GeoVision GV-LPC2211 to the latest firmware version that enforces WS-Security UsernameToken freshness and nonce reuse protection. If no update is available, restrict network access to the device and monitor ONVIF operations for suspicious replay attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart