CVE-2026-42365
Geovision Gv-Lpc2011 Firmware 1.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2026-42365 is a high-severity Predictable from Observable State (CWE-341) vulnerability in Geovision Gv-Lpc2011 Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42365 is a guessable session cookie vulnerability in the Web Interface functionality of GeoVision LPC2011/LPC2211 version 1.10, published on 2026-05-04T01:16:03.620. The issue allows a specially crafted series of HTTP requests to lead to an authentication bypass, where an attacker can bruteforce session cookies to trigger the vulnerability. It has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) and is associated with CWE-341.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity, lack of required privileges or user interaction, and network vector. Successful exploitation enables bruteforcing of session cookies to bypass authentication, resulting in high confidentiality impact across a scoped security boundary.
Advisories with potential mitigation details are available from Talos Intelligence at https://talosintelligence.com/vulnerability_reports/ and GeoVision at https://www.geovision.com.tw/cyber_security.php.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26856
Vulnerability Data
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.6.1V6.5.1V6.5.3V6.5.5
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires generation and distribution of values that cannot be derived from observable state.
Cryptographic key establishment mandates use of unpredictable, non-observable values for keys and nonces.
Session authenticity protection requires session identifiers or tokens that resist prediction from network or timing observations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require cryptographically secure random values instead of observable state such as time or PID.
Hardened configuration baselines can enforce use of cryptographically secure RNG sources and disable predictable state-based mechanisms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls replace predictable values with high-entropy, non-guessable material.
Security testing can detect predictability issues but does not prevent them by itself.
SDLC requirements encourage secure design but do not directly mandate removal of predictable state.
Secure coding practices explicitly forbid use of predictable state (time, PID, counters) for secrets or tokens.
Strong authentication mechanisms reduce reliance on predictable state-derived tokens or identifiers.
Accurate time sources limit one observable state vector but do not address broader predictability.