CVE-2026-88273: GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GeoVision GV-LPC2011/LPC2211to a version that resolves this vulnerability.Fixed in V1.13 - Compensating control
Do not allow untrusted parties to control the PPPoE username; ensure only trusted administrators can set PPPoE credentials (including PPPoE username) to prevent shell-configuration command injection.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator-level access to control the PPPoE username setting. The vector is network-based, but the stated prerequisite is high privileges.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary commands as root on the affected device. This can compromise confidentiality, integrity, and availability.
Is there a documented workaround if an update cannot be applied immediately?
No workaround or fixed version is provided in the available information. Limit administrator access and prevent untrusted parties from modifying PPPoE username settings until vendor guidance is available.