Loading vulnerability…
OS Command Injection in GeoVision LPC2011/LPC2211 DdnsSetting.cgi
CVE-2026-42364 is an OS command injection vulnerability affecting GeoVision LPC2011 and LPC2211 license-plate recognition cameras running firmware version 1.10. The flaw resides in the DdnsSetting.cgi functionality that processes DDNS configuration parameters. Insufficient sanitization of attacker-controlled DDNS configuration values allows shell metacharacters to be incorporated into system command execution on the underlying embedded GNU/Linux platform. A specially crafted DDNS configuration can therefore cause arbitrary command execution. Because the vulnerable web-facing component executes with root privileges, successful exploitation can result in command execution as root on the device.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary OS command execution on the affected camera with root privileges. This can lead to full device compromise, including complete loss of confidentiality, integrity, and availability on the camera, manipulation or disruption of surveillance functions, theft of stored or transiting data, installation of persistent malware, and use of the device as a foothold for lateral movement into adjacent physical-security or enterprise networks.
If you can’t patch tonight, do this now.
Until patched firmware can be deployed, restrict access to the camera web interface and specifically to administrative configuration functions such as DDNS settings. Prevent internet exposure, place affected cameras on segmented management networks, limit access to trusted administrators through network controls, disable DDNS functionality if operationally feasible, and monitor for suspicious attempts to modify DDNS configuration or invoke the vulnerable CGI handler.
Patch, then assume compromise.
Upgrade affected GeoVision LPC2011/LPC2211 devices from firmware 1.10 to a vendor-fixed release. Apply the vendor security update addressing the DdnsSetting.cgi input-handling flaw and validate that DDNS configuration parameters are no longer passed to system commands without proper sanitization. Review device hardening after patching, including credential rotation and verification of administrative configuration integrity.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.