A critical authentication bypass vulnerability in GeoVision GV-LPCLPC2011/2211 allows unauthenticated attackers to hijack sessions through replay attacks.

This is a capture-replay flaw (CWE-294) occurring within the WS-Security implementation. An unauthenticated attacker can capture a valid PasswordDigest token and reuse it to perform authorized ONVIF operations against the device.

Successful exploitation of this vulnerability results in full unauthorized access to the affected surveillance equipment. Given the CVSS score of 9.8, this flaw poses a critical risk, as it allows attackers to manipulate device settings, access video feeds, or potentially pivot into the internal network. The lack of authentication requirements means the attack vector is trivial for any actor with network visibility to the device.

Immediate Action: Update the GeoVision GV-LPCLPC2011/2211 firmware to version 1.14 or later to resolve the replay protection flaw.

Proactive Monitoring: Review system access logs for anomalous ONVIF command execution or repeated login attempts originating from unauthorized IP addresses.

Compensating Controls: Isolate affected cameras on a dedicated VLAN and restrict access to the ONVIF management interface using network-level firewalls.

Public Exploit Available: Unknown

This vulnerability represents a severe security failure in the device authentication process. Organizations using these GeoVision units must prioritize the firmware update to version 1.14 immediately to prevent unauthorized device control and potential surveillance data compromise.