An os command injection flaw exists in the DdnsSetting.cgi handler of GeoVision LPC2011/LPC2211 firmware 1.10. The flaw allows a specially crafted DDNS configuration to be passed to the underlying operating system, enabling an attacker to execute arbitrary shell commands. The consequence is full compromise of the device’s operating system, including confidentiality, integrity, and availability.

The vulnerability affects GeoVision Inc. firmware model GV‑LPC2011/LPC2211 version 1.10. Pixels vulnerable to this issue were patched in firmware release 1.12‑260330. Administrators who run earlier firmware should verify the version and apply the updated firmware.

With a CVSS score of 9.9 the flaw is classified as critical. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, but remote code execution is a high‑risk issue. The likely attack vector is a remote attacker sending a malicious request to the DdnsSetting.cgi web interface, which requires network reachability to the device’s management port. Successful exploitation would give the attacker the same privileges with which the CGI script runs, typically root or equivalent on the embedded Linux system.