CVE-2026-88272
HighCVSS 7.2Summary
In GeoVision GV-LPC2211 V1.13, an administrator can set a username containing shell metacharacters that are executed as arbitrary root commands when the stored username is later deleted.
Risk Assessment
An administrator-level user can exploit this to fully compromise the device and gain root-level control, potentially enabling lateral movement within the network.
Recommendation
Update the device firmware to a version that fixes the vulnerability, or restrict administrative access to trusted networks and change default credentials.
Other vulnerabilities in GeoVision GV-LPC2211
See all- CVE-2026-88290High
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, enabling remote exhaustion of memory, connection, and worker resources.
- CVE-2026-88289High
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
- CVE-2026-88288Medium
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
- CVE-2026-88287High
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
- CVE-2026-88286High
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
- CVE-2026-88284Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- CVE-2026-88283Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- CVE-2026-88282High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
- CVE-2026-88281Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
- CVE-2026-88280Medium
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
Original NVD description (English source)
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.