OS Command Injection Vulnerability in GeoVision's LPC2011 and LPC2211
CVE-2026-42364

9.9CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-lpc2011/lpc2211
Vendor
CVE Published:
4 May 2026

What is CVE-2026-42364?

An OS command injection vulnerability exists within the DdnsSetting.cgi functionality in GeoVision's LPC2011 and LPC2211 products. By crafting a specially designed DDNS configuration, an attacker can manipulate configuration values, enabling the execution of arbitrary commands on the affected device. This vulnerability poses a significant risk as it can lead to unauthorized control and actions that compromise the integrity and security of the affected systems.

Affected Version(s)

GV-LPC2011/LPC2211 Linux 1.10

GV-LPC2011/LPC2211 Linux 1.12

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisory
https://talosintelligence.com/vulnerability_reports/
third-party-advisory

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos.
Kelly Patterson of Cisco Talos.
Martin Zeiser of Cisco Talos.
.