What is the CVSS score of CVE-2026-88282?

CVE-2026-88282 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoVision GV-LPC2211 are affected by CVE-2026-88282?

GeoVision's GV-LPC2211 and GV-LPC2011 license plate recognition cameras running firmware V1.13 contain a command injection vulnerability allowing authenticated administrators to execute arbitrary…

How to fix or mitigate CVE-2026-88282?

Within 24 hours, isolate affected GeoVision cameras on a separate network segment restricted from critical systems and conduct an immediate audit of all administrator accounts with access to these devices, implementing password resets for high-risk accounts. Within 7 days, create a comprehensive inventory of all deployed GeoVision GV-LPC2211/2011 devices running firmware V1.13, monitor FTP account update operations and administrator login attempts for suspicious activity, and review logs for any evidence of unauthorized access or commands. Within 30 days, contact GeoVision directly to confirm patch status for affected devices; prioritize firmware upgrades or hardware replacement based on criticality and implement compensating controls including network-level administrative access restrictions and continuous monitoring of all camera configuration changes.

GeoVision GV-LPC2211 CVE-2026-88282

EUVD-2026-75316 HIGH

OS Command Injection (CWE-78)

2026-09-10 GV

GHSA-6vr9-mgc7-5w2c

Command Injection Gv Lpclpc2011 2211 Geovision Inc

7.2

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-accessible admin web interface (AV:N), administrator account required to set FTP username (PR:H); root command execution yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 10, 2026 - 09:06 vuln.today

CVE Published

Sep 10, 2026 - 08:23 cve.org

HIGH 7.2

DescriptionCVE.org

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.

AnalysisAI

Root-level command injection in GeoVision GV-LPC2211 and GV-LPC2011 license plate recognition cameras (firmware V1.13) allows an authenticated administrator to execute arbitrary OS commands as root by embedding shell metacharacters in the FTP account username field. The injected payload is executed during a subsequent FTP-account update operation, yielding complete device compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session with administrator-level privileges on the GeoVision GV-LPC2211 or GV-LPC2011 web management interface (confirmed by CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the key risk dynamic: administrative credentials are required (PR:H), which meaningfully constrains the attacker pool compared to unauthenticated flaws, yet successful exploitation delivers full root-level control over the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the GeoVision cybersecurity advisory page at https://www.geovision.com.tw/cyber_security.php for firmware updates addressing CVE-2026-88282; no exact patched firmware version has been independently confirmed at time of analysis, so monitor this page for release announcements. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, isolate affected GeoVision cameras on a separate network segment restricted from critical systems and conduct an immediate audit of all administrator accounts with access to these devices, implementing password resets for high-risk accounts. …

Threat intelligence, references, and detailed analysis are available after sign-in.