Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 4 products
| Date | Total | Labels |
|---|
| 2026-05-04 | 1 | General1 |
| 2026-05-13 | 2 | General2 |
| 2026-05-15 | 1 | Patch1 |
| 2026-06-02 | 5 | Disclosure5 |
| 2026-06-17 | 1 | Disclosure1 |
Unpopular opinion: The cybersecurity industry is selling you dashboards. CVE: CVE-2026-42364 CVSS: 9.9 (3.1) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text announces CVE-2026-42364 with a critical severity rating and detailed CVSS metrics, but offers no evidence of exploitation, PoC, or mitigation.
Impact vs Product vs CVSS vs Vector: CVE-2026-42369: RCE as SYSTEM (no ASLR) (vs Product GV-VMS V20 | CVSS **10.0** | Vector Remote, Unauth) CVE-2026-42370: RCE via login stack overflow (vs Product GV-VMS V20 20.0.2 | CVSS 9.0 | Vector Remote, Unauth) CVE-2026-42364: OS…
Post summary
The snippet lists three CVEs (CVE-2026-42369, CVE-2026-42370, CVE-2026-42364) with high severity RCE vulnerabilities, detailing product versions and CVSS scores, but contains no PoC, exploit code, or mitigation references.
TL;DR GeoVision GV-VMS V20 has a CVSS 10.0 unauthenticated stack overflow RCE in its WebCam Server component (CVE-2026-42369), disclosed today. A companion command injection flaw (CVE-2026-42364) hits network-connected LPC cameras at CVSS 9.9. Both allow remote code…
Post summary
The post announces the disclosure of two high‑impact vulnerabilities in GeoVision products, specifying RCE via stack overflow and command injection, but provides no evidence of exploitation or remediation yet.
Simultaneously, a companion critical flaw (CVE-2026-42364) was disclosed in GeoVision LPC2011/LPC2211 network cameras—a CVSS 9.9 OS command injection in the DDNS configuration handler that allows unauthenticated attackers to inject arbitrary shell commands.
Post summary
The passage announces a newly disclosed critical flaw (CVE-2026-42364) in GeoVision LPC2011/LPC2211 network cameras, detailing a CVSS 9.9 OS command injection that permits unauthenticated shell injection via the DDNS configuration handler.
A critical OS command injection vulnerability (CVE-2026-42364, CVSS 9.9) in GeoVision LPC2011/2211 surveillance cameras (firmware 1.10) allows unauthenticated remote attackers to execute arbitrary commands by manipulating DDNS configuration values. No patch available yet.…
Post summary
A critical OS command injection vulnerability (CVE-2026-42364) affecting GeoVision LPC2011/2211 cameras allows unauthenticated remote command execution via DDNS configuration values, with CVSS 9.9; no patch is available yet.
The Surveillance Perimeter Just Cracked: GeoVision LPC2011/2211 Unauthenticated RCE via DDNS Injection (CVE-2026-42364). A critical OS command injection vulnerability CVE-2026-42364, CVSS 9.9 in GeoVision LPC2011/2211 surveillance cameras firmware 1.10 allows…
Post summary
A critical OS command injection vulnerability (CVE‑2026‑42364) with a CVSS score of 9.9 was disclosed for GeoVision LPC2011/2211 surveillance cameras, allowing unauthenticated remote code execution via DDNS injection.
Sources The HackerWire: GeoVision LPC2011/LPC2211 Critical OS Command Injection (CVE-2026-42364) NVD: CVE-2026-42364 The Surveillance Perimeter Just Cracked: GeoVision LPC2011/2211 Unauthenticated RCE via DDNS Injection
Post summary
The text announces CVE‑2026‑42364 for GeoVision LPC2011/2211 as a critical OS command injection, providing technical details but no evidence of PoC, active exploitation, or patch.
A critical OS command injection vulnerability (CVE-2026-42364) affects GeoVision LPC2011/LPC2211 devices. SMBs and healthcare orgs using these should review device configs and patch immediately to prevent unauthorized control. #cybersecurity
Post summary
The post identifies a critical OS command injection vulnerability in GeoVision devices and urges immediate patching to prevent unauthorized control.
https://lyrie.ai/research/research/cve-2026-42364-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
Only a URL and hashtags are provided, lacking any substantive detail about the CVE. The information is insufficient for a more specific classification.
CVE-2026-42364 OS Command Injection in GeoVision LPC2011/LPC2211 1.10 DdnsSettin... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42364 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet references CVE‑2026‑42364 as an OS command‑injection vulnerability in GeoVision devices but provides no proof‑of‑concept, exploit, active use, or patch information, merely linking to a vulnerability details page.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | geovision | gv-lpc2011 | - | - | - |
| OS | geovision | gv-lpc2011_firmware | 1.10 | - | - |
| HW | geovision | gv-lpc2211 | - | - | - |
| OS | geovision | gv-lpc2211_firmware | 1.10 | - | - |