Description

GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T09:17:04.787Z",
  "pubdate": "2026-09-10T09:17:04.787Z",
  "executiveSummary": "The GeoVision GV-LPC2211 V1.13 is susceptible to an authentication replay attack due to the improper implementation of WS-Security standards within its ONVIF interface. The device fails to enforce mandatory freshness checks or nonce validation for UsernameToken authentication mechanisms.\nThis vulnerability allows an unauthenticated attacker, situated within the network path, to capture a valid PasswordDigest token and subsequently replay it to authenticate as an authorized user. The impact is critical, as it bypasses standard authentication controls, granting unauthorized access to the device’s ONVIF-based management and operational functionalities. No additional credentials or secrets are required if a valid token is obtained through traffic interception. The flaw resides in the processing logic of the WS-Security layer, which does not verify the uniqueness or the temporal validity of the provided nonce, effectively rendering captured authentication material indefinitely valid for further command execution.\nThe risk is significant in environments where network traffic is not encrypted or protected against man-in-the-middle interception, potentially allowing attackers to gain full control over surveillance operations or device configuration.",
  "technicalDetails": "The vulnerability originates from the failure of the GeoVision GV-LPC2211 V1.13 ONVIF service to implement stateful verification of WS-Security UsernameToken elements. According to the WS-Security specification, a PasswordDigest authentication requires the client to provide a Nonce and a Created timestamp alongside the digest to prevent replay attacks. The server is expected to track nonces or enforce a strict expiration window based on the timestamp to ensure that each authentication request is unique and transient.\nIn the affected GV-LPC2211 implementation, the device omits these essential security checks. Consequently, the backend authentication service accepts the PasswordDigest token provided in the SOAP header without verifying if the Nonce has been used previously or if the timestamp exceeds acceptable drift thresholds. This effectively reduces the security of the authentication scheme to a static, reusable credential.\nThe attack flow proceeds as follows: First, an adversary positions themselves to monitor network traffic between the legitimate client and the GV-LPC2211 device. Because ONVIF communication often occurs over unencrypted HTTP, the attacker intercepts the initial SOAP request containing the WS-Security header. This header includes the Username, the PasswordDigest, the Nonce, and the Created timestamp. Second, the attacker captures these specific tokens. Third, because the device does not maintain a cache of previously used nonces or perform temporal validation, the attacker can submit identical SOAP requests to the ONVIF endpoint at a later time. The device, upon processing the replayed request, validates the PasswordDigest against its internal records and grants the attacker an authenticated session. This allows the attacker to issue legitimate ONVIF commands, such as retrieving video streams, modifying device configurations, or altering PTZ settings, without ever knowing the actual plaintext password of the authorized user. The lack of strict adherence to WS-Security standards significantly lowers the barrier for persistent, unauthorized remote access to the camera's control plane."
}