Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Opening a crafted legacy Excel (.xls) file in libxls 1.6.3, or in any application that embeds it, can corrupt the heap and potentially execute arbitrary code because xls_getCSS() trusts a file-controlled font index without validating it against the workbook's font count. The same code path also permits use-after-free/out-of-bounds access to the font array while generating CSS from XF formatting records. Exploitation requires a victim to open a malicious file (CVSS AV:L/UI:R); no public exploit code has been confirmed and CISA KEV does not list this CVE, with EPSS very low at 0.15% (5th percentile), indicating limited real-world targeting at time of analysis.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. The scope-changed CVSS vector (S:C) reflects that the primary harm falls on systems outside consul-template itself: Vault secrets meant to be accessed only by privileged services instead persist in Nomad task events and logging infrastructure accessible to broader audiences.
Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Denial of service in Suricata IDS/IPS/NSM engine (versions prior to 7.0.16 and 8.0.5) allows an unauthenticated remote attacker to exhaust CPU resources by sending HTTP responses containing crafted oversized `Content-Disposition` headers, causing the inspection engine to perform repeated expensive parsing iterations without bounds. The attack requires no privileges and exploits the security tooling itself - disabling Suricata's inspection capability - which can serve as a precursor to attacks that would otherwise be detected. No public exploit code and no CISA KEV listing have been identified, but the OISF has released patched versions and a rule-based workaround.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. No public exploit code has been identified and it is not listed in CISA KEV, but the zero-prerequisite network vector makes automated scanning trivially feasible at scale.
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources inaccessible to the attacker directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this requires no authentication and trivial network access, with high confidentiality impact. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. Exploitation enables persistent unauthorized broker state manipulation and denial-of-service through storage and memory exhaustion, with no credentials or user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a958) lets an attacker stall or crash the planner by driving the EGOReplanFSM component into uncontrolled resource consumption (CWE-400). The vulnerable component is the finite state machine that orchestrates local trajectory replanning for autonomous quadrotors, so a successful attack removes fresh trajectory generation from the flight stack. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), EPSS 0.17% (6th percentile) and no CISA KEV listing; no public exploit code is confirmed in the supplied metadata, although the report references a public GitHub issue and a gist that may contain reproduction detail.
Denial of service in the Robotics-STAR-Lab (SYSU STAR Group) RACER autonomous exploration framework allows an unauthenticated remote attacker who can reach the exploration stack to disrupt its exploration state machine, halting or crashing mission execution on an affected robot. The flaw is an improper check or handling of exceptional conditions (CWE-703) that is remotely reachable with low complexity and no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only high impact). No public exploit code was identified in the supplied metadata and exploitation likelihood is very low (EPSS 0.17%, 6th percentile), consistent with RACER being a niche academic robotics project rather than widely deployed production software.
Denial-of-service in EGO-Planner-v2, ZJU-FAST-Lab's open-source drone trajectory replanning framework, allows unauthenticated remote attackers to crash the planning process by triggering uncontrolled resource consumption in three FSM callback functions. All repository commits up to 5c99a95880401e2599638d567abc0e240396cb42 are affected, with no vendor-released patch identified at time of analysis. A public gist documenting the issue exists, though no confirmed active exploitation has been observed, and EPSS is extremely low at 0.17%.
Out-of-bounds read in libxls 1.6.3 allows a remote, unauthenticated attacker to leak heap memory contents by supplying a maliciously crafted XLS file with manipulated OLE Property Set Stream offsets. The vulnerability resides in xls_dumpSummary(), which dereferences file-controlled section and property offsets against a 4096-byte OLE summary buffer without first validating that those offsets remain within buffer bounds. Any server-side or automated pipeline that parses untrusted XLS files via libxls is exposed; no public exploit code has been identified and EPSS stands at 0.15%, indicating low current exploitation activity.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. No public exploit or active exploitation has been confirmed at time of analysis.
Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. No public exploit code has been identified at time of analysis, and Patchstack is the sole reporting source.
NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.
Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.
Password recovery exploitation in LIBRID/LIBREF (a library management platform by Turkish vendor Ankaref Innovation and Technology Inc.) allows unauthenticated remote attackers to compromise user accounts by abusing a weak forgotten-password mechanism (CWE-640). All versions from 2.01.0.2183 through the build dated 10092026 are affected, and no vendor patch exists - the vendor did not respond to TR-CERT's disclosure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the combination of no authentication required, low complexity, and no vendor patch sustains meaningful account-takeover risk for any publicly accessible deployment.
Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote attackers to read arbitrary files from the server filesystem via crafted HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction, and no elevated privileges are required, with high confidentiality impact. The vulnerability was disclosed by TR-CERT under advisory TR-26-1063; no public exploit code or CISA KEV listing has been identified at time of analysis.
Index mishandling in the OCaml cstruct library before 6.3.0 allows network-reachable attackers to trigger partial confidentiality, integrity, and availability impacts via crafted binary data passed to affected parsing routines. cstruct is a low-level binary buffer manipulation library used widely in OCaml network stacks and the MirageOS unikernel ecosystem; improper index handling can bypass the library's internal bounds logic, exposing adjacent memory or corrupting buffer state. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Command injection in Renovate's Mix package manager allows an attacker who can control private dependency package names to execute arbitrary OS commands as the Renovate process user. Versions before 44.14.7 fail to escape organization parameters before passing them to shell commands during dependency resolution in binarySource=docker mode. No public exploit code has been identified at time of analysis, but the attack surface is reachable whenever Renovate processes Elixir/Mix private dependencies under the affected configuration.
Command injection in Renovate's gomod manager (before 44.14.7) exposes CI/CD pipelines to arbitrary shell command execution as the Renovate user when a maliciously crafted Go module dependency name containing shell metacharacters is processed. The flaw is exercised only under two simultaneously required non-default configurations - `binarySource=docker` mode and `postUpdateOptions gomodUpdateImportPaths` enabled - confining exposure to a specific subset of Renovate deployments performing Go module major version updates. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary commands with root privileges by setting a WEP key value containing embedded shell metacharacters. The root cause (CWE-78) is unsanitized passthrough of administrator-supplied WiFi configuration input into a system shell call on the embedded device OS. No public exploit code or active exploitation has been identified at time of analysis.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen.
Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface.