EUVD-2026-75310
GHSA-v3q5-2qg4-4m6h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Administrator credentials are required (PR:H); the management interface is network-accessible (AV:N); injected commands run as root yielding full CIA:H impact with no scope change.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
2DescriptionCVE.org
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
AnalysisAI
OS command injection in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary commands with root privileges by setting a WEP key value containing embedded shell metacharacters. The root cause (CWE-78) is unsanitized passthrough of administrator-supplied WiFi configuration input into a system shell call on the embedded device OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrator-level credentials for the GeoVision GV-LPC2211 web management interface (PR:H per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures the risk profile: while the impact upon successful exploitation is total device compromise, the PR:H requirement - administrator credentials - is a meaningful barrier that significantly narrows the exploitable attacker population to insiders, credential-reuse attacks, or scenarios where default or shared admin passwords are in use. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the GeoVision cybersecurity advisory at https://www.geovision.com.tw/cyber_security.php for a patched firmware release; no specific fixed version number is confirmed in the currently available references beyond the affected V1.13. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all GeoVision GV-LPC2211 devices running firmware V1.13 and document their network location and criticality; restrict administrative access to essential personnel only with strong credential controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gv Lpclpc2011 2211
View allRemote code execution in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (firmware V1.12 and earli
Unauthenticated remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate camera
Remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (V1
Remote unauthenticated stack-based buffer overflow in the vlsvr login service of GeoVision GV-LPC2011 and GV-LPC2211 lic
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC20
Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute
Unauthenticated format string flaw in the vlsvr service of GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate capture devices (firmware V1.12 and earlier) lets
Arbitrary file read in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition appliances (firmware V1.12 and earl
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-capture devices (firmware V1.12 and earlier) allo
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier)
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate cameras (firmware V1.12 and earlier) lets remote
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today