GeoVision LPC2011/LPC2211 EUVD-2026-26855

Attacker must (1) have network reachability to the camera's web administration interface (HTTP/HTTPS on the management network), (2) hold valid low-privilege credentials for the device's web UI per the CVSS PR:L metric, and (3) be able to submit a DDNS configuration through DdnsSetting.cgi - i.e., the DDNS settings code path must be exposed and writable to the attacker's account role. No user interaction by another operator is required (UI:N). Exploitation is limited to GV-LPC2011/LPC2211 firmware 1.10; other GeoVision models and firmware versions are not in scope of the published data, and devices where the management interface is restricted to a jump host or VPN are not exploitable from the open network.

Signals are mixed but lean toward 'real but bounded' priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and SSVC technical impact of 'total' are consistent with full device takeover over the network with only low privileges, but SSVC also marks Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.17% (38th percentile) - meaning despite the high CVSS, real-world exploitation is currently neither observed nor likely at scale. The PR:L requirement is the key limiter: an attacker must already hold a valid (even low-privilege) account or have hijacked a session on the camera's web UI, which significantly reduces opportunistic risk on Internet-exposed devices that still use credentials. Note that the description gives no explicit account role, so PR:L is taken from the assigned CVSS vector; if the DDNS settings page is in practice reachable only by an admin account, real-world risk is lower still.

An attacker who has obtained or guessed any low-privilege account on an Internet-exposed or LAN-reachable GV-LPC2011/LPC2211 camera browses to the DDNS configuration page and submits a DDNS server, hostname, or credential field containing shell metacharacters (for example, a value terminated by ';' or backticks invoking wget|sh). When the camera saves the configuration and invokes its DDNS updater, the injected command runs as the web server user (typically root on these embedded devices), giving the attacker an interactive shell, persistence via firmware modification, and a pivot into the surveillance network. No public exploit identified at time of analysis, but the vulnerability class is trivial to weaponize once a valid login or a session is obtained.