CVE-2026-57872

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57872", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-06-26T02:40:42.397Z", "datePublished": "2026-06-26T07:17:05.315Z", "dateUpdated": "2026-06-26T15:27:13.920Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-06-26T07:17:05.315Z"}, "title": "GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi)", "datePublic": "2026-06-26T02:55:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "1.12"}, {"status": "unaffected", "version": "1.13"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-lpclpc2011_2211:1.12:*:linux:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-lpclpc2011_2211:1.13:*:linux:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated\ndirectory traversal vulnerability exists in get_fcont.cgi in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient validation of user-supplied file path input before the requested\nfile is accessed by the CGI component. A remote attacker may exploit this\nvulnerability by sending a crafted request to read arbitrary files accessible\nto the affected process, resulting in information disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An unauthenticated\ndirectory traversal vulnerability exists in get_fcont.cgi in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient validation of user-supplied file path input before the requested\nfile is accessed by the CGI component. A remote attacker may exploit this\nvulnerability by sending a crafted request to read arbitrary files accessible\nto the affected process, resulting in information disclosure.</p>"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "timeline": [{"time": "2026-06-17T07:08:00.000Z", "lang": "en", "value": "Finder reports vulnerability to vendor"}], "credits": [{"lang": "en", "value": "Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University has reported:", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T15:27:02.607977Z", "id": "CVE-2026-57872", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T15:27:13.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T15:27:02.607977Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T15:27:08.099Z"}}], "cna": {"title": "GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University has reported:"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "versions": [{"status": "affected", "version": "1.12"}, {"status": "unaffected", "version": "1.13"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-17T07:08:00.000Z", "value": "Finder reports vulnerability to vendor"}], "datePublic": "2026-06-26T02:55:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "An unauthenticated\ndirectory traversal vulnerability exists in get_fcont.cgi in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient validation of user-supplied file path input before the requested\nfile is accessed by the CGI component. A remote attacker may exploit this\nvulnerability by sending a crafted request to read arbitrary files accessible\nto the affected process, resulting in information disclosure.", "supportingMedia": [{"type": "text/html", "value": "<p>An unauthenticated\ndirectory traversal vulnerability exists in get_fcont.cgi in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient validation of user-supplied file path input before the requested\nfile is accessed by the CGI component. A remote attacker may exploit this\nvulnerability by sending a crafted request to read arbitrary files accessible\nto the affected process, resulting in information disclosure.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:gv-lpclpc2011_2211:1.12:*:linux:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:geovision_inc.:gv-lpclpc2011_2211:1.13:*:linux:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-06-26T07:17:05.315Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57872", "state": "PUBLISHED", "dateUpdated": "2026-06-26T15:27:13.920Z", "dateReserved": "2026-06-26T02:40:42.397Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-06-26T07:17:05.315Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "GV-LPCLPC2011/2211", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "1.12"}, {"status": "unaffected", "version": "1.13"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated\ndirectory traversal vulnerability exists in get_fcont.cgi in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient validation of user-supplied file path input before the requested\nfile is accessed by the CGI component. A remote attacker may exploit this\nvulnerability by sending a crafted request to read arbitrary files accessible\nto the affected process, resulting in information disclosure."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio no autenticado existe en get_fcont.cgi en GeoVision GV-LPC2011 y GV-LPC2211 V1.12 y versiones anteriores. La vulnerabilidad es causada por validaci\u00f3n insuficiente de la entrada de ruta de archivo proporcionada por el usuario antes de que el componente CGI acceda al archivo solicitado. Un atacante remoto puede explotar esta vulnerabilidad enviando una solicitud manipulada para leer archivos arbitrarios accesibles al proceso afectado, lo que resulta en revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-57872", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57872", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T15:27:02.607977Z", "version": "2.0.3"}}]}, "published": "2026-06-26T08:16:24.123", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "1.12"}}, {"platform": ["linux"], "status": "unaffected", "versions": {"scheme": "generic", "value": "1.13"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 91.0, "source": "matching"}]}, "original": {"product": "GV-LPCLPC2011/2211", "source": "cna", "vendor": "GeoVision Inc."}, "product": "gv-lpc2011_lpc2211", "vendor": "geovision_inc."}], "created": "2026-06-26T08:30:04.770275+00:00", "updated": "2026-06-29T20:00:03.692651+00:00", "vendors": ["geovision_inc.", "geovision_inc.$PRODUCT$gv-lpc2011_lpc2211"]}