CVE-2026-42364

The vulnerability exists in the DdnsSetting.cgi component responsible for DDNS configuration handling. An attacker with network access can submit a specially crafted DDNS configuration containing malicious input. Insufficient validation of configuration values causes this data to be passed directly to a system shell call (OS command injection), resulting in the execution of arbitrary commands in the context of the device.

An attacker can remotely execute arbitrary system commands on the vulnerable device, gaining full control over its operation, and potentially also over the network to which it is connected — including the ability to read and modify data as well as disrupt service availability.

Apply patches available from the manufacturer according to the references (https://www.geovision.com.tw/cyber_security.php). Until the update is applied, it is recommended to restrict network access to the device management interface only to trusted hosts and isolate devices in a dedicated network segment.

GeoVision GV-LPC2011 and GV-LPC2211 with firmware version 1.10