GeoVision GV-LPC2211 CVE-2026-88277

Exploitation requires a valid ONVIF user account on the target GeoVision GV-LPCLPC2211 running firmware V1.13. The attacker must be able to reach the camera's ONVIF HTTP interface over the network - typically the LAN on port 80 or 8080. No additional elevated privileges beyond basic ONVIF authentication are required; any ONVIF-capable account (including read-only or event-subscription accounts) is sufficient to trigger the injection via the ConsumerReference.Address parameter in a WS-BaseNotification Subscribe request. What limits exploitation: an attacker without any valid ONVIF credential cannot exploit this remotely; network segmentation isolating cameras to a dedicated VLAN without external access further restricts the reachable attacker population. No user interaction by a victim is required once credentials are obtained.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the risk profile. The network attack vector is appropriate since ONVIF operates over HTTP/SOAP, accessible on the LAN or, in poorly segmented networks, from the internet. PR:L acknowledges that any valid ONVIF credential is required - this is not unauthenticated exploitation. In physical security deployments, ONVIF credentials are frequently shared across integrators, VMS platforms, and maintenance personnel, meaning the effective attacker pool is broader than a typical 'authenticated' classification implies. Scope:Unchanged understates the potential impact if the camera is bridged to a corporate network segment. No CISA KEV listing and no identified public exploit code lower the immediate exploitation urgency, but LPC cameras are high-value targets due to their network positioning. EPSS data is absent from the input; risk prioritization should weight the LAN-accessible, low-complexity, root-impact profile heavily against the authentication barrier.

An attacker with any valid ONVIF account - such as a VMS integration service account, a contractor credential, or credentials obtained via reuse from another compromised camera - sends a crafted ONVIF Subscribe SOAP request to the camera's HTTP management interface, embedding shell metacharacters in the ConsumerReference.Address field (e.g., a value containing backtick or semicolon sequences). The firmware passes this value unsanitized to a shell command, resulting in arbitrary code execution as root. The attacker can then install a persistent reverse shell, exfiltrate the camera's private keys and stored footage, or pivot into adjacent network segments accessible to the camera.