GeoVision GV-LPCLPC2011/2211 version 1.13 contains an OS command injection vulnerability (CWE-78) where an administrator-controlled FTP username with shell metacharacters is improperly neutralized. This input is executed as root commands during FTP account updates, enabling arbitrary command execution at the highest privilege level. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary commands as root on the affected device. This can lead to complete system compromise, including unauthorized access, data manipulation, and service disruption. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and avoid using FTP usernames containing shell metacharacters. Monitor vendor communications for updates on patches or mitigations.