An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can …

A critical OS command injection vulnerability (CVE-2026-42364) has been identified in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. The vulnerability allows attackers to execute arbitrary commands by crafting malicious DDNS configuration values. An attacker can exploit this flaw by modifying configuration parameters, leading to complete system compromise. The vulnerability affects the DDNS (Dynamic DNS) settings component of the affected GeoVision devices. This represents a high-severity security issue that could allow remote code execution on vulnerable systems.