This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) within the DdnsSetting.cgi component of GeoVision GV-LPC2011/LPC2211 firmware version 1.10. An attacker with low privileges can modify DDNS configuration values to inject and execute arbitrary OS commands. The vulnerability is publicly disclosed with a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows an attacker with limited privileges to execute arbitrary operating system commands on the affected device, potentially leading to full system compromise, data loss, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the DDNS configuration interface to trusted users only and monitor for unauthorized configuration changes. Avoid exposing the affected device's management interfaces to untrusted networks.