A critical command injection vulnerability in GeoVision GV-LPC2211 devices allows authenticated attackers to gain full root-level control over the system.

This is an OS command injection flaw (CWE-78) triggered through the ConsumerReference.Address field in the ONVIF interface. The vulnerability requires the attacker to have authenticated access to the device, after which they can execute arbitrary system commands with root privileges.

Successful exploitation of this vulnerability grants an attacker complete control over the affected device, potentially leading to unauthorized surveillance, network pivot attacks, or total loss of system integrity. With a CVSS score of 8.8, this represents a high-severity risk that could result in significant operational disruption and the compromise of sensitive video security infrastructure.

Immediate Action: Update the GeoVision GV-LPC2211 firmware to version 1.14 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Review access logs for the ONVIF service and monitor for suspicious shell commands or unauthorized modifications to system configuration files.

Compensating Controls: Restrict network access to the ONVIF interface to authorized management subnets only and enforce strict authentication policies to minimize the risk of malicious users gaining the required initial access.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for full system compromise via root-level command execution, necessitates immediate action. Administrators must prioritize updating all affected GeoVision units to version 1.14 or newer to eliminate the command injection vector. Ensure that all security patches are applied in accordance with the vendor's updated guidance.