EUVD-2026-26855CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.
AnalysisAI
OS command injection in GeoVision LPC2011/LPC2211 version 1.10 allows authenticated remote attackers to execute arbitrary commands with system privileges by crafting malicious DDNS configuration values in the DdnsSetting.cgi component. The vulnerability (CVSS 9.9, Critical) requires only low-level authentication and enables full system compromise with scope change, indicating potential lateral movement to other network segments. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all GeoVision LPC2011/LPC2211 devices and document current firmware versions; restrict network access to DDNS configuration interfaces (DdnsSetting.cgi) via firewall or network segmentation. Within 7 days: Contact GeoVision support for patch availability timeline and interim guidance; implement principle of least privilege to limit users with DDNS configuration rights. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today