ONVIF PasswordDigest Token Replay in GeoVision Cameras

GeoVision GV-LPC2211 V1.13 surveillance cameras contain a critical authentication bypass vulnerability (CVE-2026-88278, CVSS 9.8) in their ONVIF implementation. The device fails to validate WS-Security UsernameToken freshness or implement nonce reuse protection, meaning an attacker who captures a PasswordDigest token can replay it indefinitely to gain unauthorized access to camera operations. This affects organizations deploying these IP cameras in security infrastructure, as the vulnerability enables complete compromise of camera control without requiring credential theft or password cracking—only passive network observation. Given the widespread use of GeoVision cameras in enterprise surveillance systems, physical security facilities, and critical infrastructure, this represents a significant risk to organizations relying on ONVIF-compliant devices for access control and monitoring.

While this CVE currently maps to zero Casky skills (indicating limited direct MITRE ATT&CK alignment), practitioners using Casky's extended reasoning capabilities would detect attack patterns associated with Credential Access techniques through network behavior analysis. The platform's 754 mapped security skills would help identify reconnaissance activity (T1592 - Gather Victim Identity Information) as attackers probe for ONVIF endpoints, and T1040 (Traffic Capture) patterns showing repeated identical authentication tokens crossing network boundaries. A practitioner reviewing Casky findings would observe anomalies including: identical PasswordDigest values appearing in multiple ONVIF requests over time, absence of changing nonce values in captured authentication streams, and successful ONVIF method invocations using replayed tokens from earlier sessions. This token reuse signature—particularly the lack of temporal variation—becomes the observable indicator that distinguishes replay attacks from legitimate authentication flows in network telemetry and API logs.