Cyber Resilience

CVE-2026-57880

Critical

Published: 26 June 2026

Published
26 June 2026
Modified
26 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0053 40.9th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-57880 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Com (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending…

more

a crafted RTSP request containing overly long authentication data, resulting in memory corruption, denial of service, or potentially arbitrary code execution.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote stack buffer overflow in public-facing RTSP service directly enables initial access via exploitation of an Internet-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Com
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248594 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. via CWE-121
Oracle Linux 9 (1 rule)
  • V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. via CWE-121

References