VulnSocial

CVE-2026-88278Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-294

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-11); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-11: 1Mentions · 2026-09-15: 1Patch / Workaround · 2026-09-11: 1Patch / Workaround · 2026-09-15: 1Technical Details · 2026-09-11: 1Technical Details · 2026-09-15: 109-1109-15
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • CCB Alert@CCBalert
    Patch

    Warning: 2 critical vulnerabilities in #GeoVision GV-LPC2211 allow attackers to replay captured tokens and issue PTZ commands without authentication. CVE-2026-88278 CVSS(3.1): 9.8 CVE-2026-88285 CVSS(3.1): 9.4 Read the advisory https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-LPC2011-2211-2026-09-01.pdf and #Patch #Patch #Patch

    Post summary

    GeoVision issued an advisory for two critical CVEs that allow token replay and unauthenticated PTZ commands, and directs users to apply vendor patches.

    01000261
    7.2K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-88278 (CVSS 9.8) GeoVision GV-LPC2211 V1.13 vulnerable to WS-Security token replay attacks. Captured credentials can be reused for unauthorized ONVIF operations. Patch immediately if deployed. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/WFrJmEw0KA

    Post summary

    The tweet discloses a critical CVE‑2026-88278 affecting GeoVision devices, describes the WS‑Security token replay vulnerability and its high CVSS score, and urges immediate patching.

    0000046
    138 followersView on X

Explore more

Back to dashboard