The vulnerability CVE-2026-42364 affects GeoVision Inc.'s GV-LPC2011/LPC2211 devices running version 1.10. It is an OS command injection flaw (CWE-78) in the DdnsSetting.cgi component. An attacker with limited privileges can supply a malicious DDNS configuration value that is improperly neutralized, leading to arbitrary command execution on the underlying operating system. This can compromise the device's confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or official remediation is currently documented by the vendor.

Successful exploitation allows an attacker with limited privileges to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. The CVSS score of 9.9 reflects critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected device's management interfaces to trusted users only and monitor for suspicious configuration changes. Avoid applying untrusted DDNS configurations. Follow vendor communications closely for updates.