Cyber Resilience

CVE-2026-42368

CriticalUpdated

Published: 04 May 2026

Published
04 May 2026
Modified
15 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0035 26.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-42368 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Geovision Gv-Lpc2011 Firmware. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-42368 is a privilege escalation vulnerability (CWE-266) in the Web Interface functionality of GeoVision LPC2011/LPC2211 version 1.10. A specially crafted HTTP request can lead to the execution of privileged operations, with the attacker able to trigger the issue simply by visiting a webpage.

The vulnerability has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity by an attacker possessing low privileges, requiring no user interaction and resulting in a scope change. Successful exploitation enables the attacker to gain elevated privileges, achieving high impacts on confidentiality, integrity, and availability.

Mitigation details are available in advisories from Talos Intelligence (https://talosintelligence.com/vulnerability_reports/) and GeoVision (https://www.geovision.com.tw/cyber_security.php).

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.

CWE(s)
CWE-266

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Directly matches Exploitation for Privilege Escalation (T1068) via crafted HTTP request in web interface leading to unauthorized privileged operations (CWE-266).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42364Same product: Geovision Gv-Lpc2011
CVE-2026-7371Same product: Geovision Gv-Lpc2011
CVE-2026-42365Same product: Geovision Gv-Lpc2011
CVE-2026-42366Same product: Geovision Gv-Lpc2011
CVE-2025-33179Shared CWE-266
CVE-2024-49644Shared CWE-266
CVE-2024-56280Shared CWE-266
CVE-2026-42758Shared CWE-266
CVE-2026-32530Shared CWE-266
CVE-2025-22736Shared CWE-266

Affected Assets

geovision
gv-lpc2011 firmware
1.10
geovision
gv-lpc2211 firmware
1.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2026-42368 by requiring timely patching of the privilege escalation flaw in the GeoVision LPC2011/LPC2211 web interface as per vendor advisories.

SI-10 Information Input Validation good match
prevent

Validates specially crafted HTTP requests to the web interface, preventing execution of privileged operations.

AC-3 Access Enforcement good match
prevent

Enforces access control policies to block unauthorized privileged operations triggered by low-privilege users via the vulnerable web interface.

References