Executive brief
The GeoVision GV-LPC2211 is a network video recorder used for surveillance system control. A vulnerability allows an administrator to inject shell commands via a specially crafted username; when that username is later deleted from the system, the injected commands execute with root privileges, potentially compromising the entire device and recorded video data.
Technical details
The vulnerability is a command injection flaw in the user account deletion functionality of GeoVision GV-LPC2211 V1.13. An authenticated administrator can create a user account with a username containing shell metacharacters (e.g., backticks, pipes, semicolons). When the administrator later deletes this user, the system fails to properly sanitize the username before passing it to a shell command, allowing arbitrary command execution as root. The attack requires administrator-level access to create and delete user accounts, but results in unauthenticated remote code execution with elevated privileges. No patch availability information is currently available.
Affected products
- GeoVision GV-LPC2211 V1.13
Timeline
- 2026-09-10: disclosed