GeoVision Camera PPPoE Command Injection as Root

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-88273 is a critical command injection vulnerability in GeoVision GV-LPC2211 IP cameras (V1.13) that allows authenticated administrators to escape shell metacharacters in the PPPoE username field and execute arbitrary commands with root privileges. This affects network-connected surveillance infrastructure across enterprises, government facilities, and critical infrastructure operators who deploy these cameras for physical security monitoring. The vulnerability is particularly dangerous because it requires only administrator-level access—a common attack vector when credentials are compromised, shared, or obtained through social engineering—making it a reliable post-authentication privilege abuse technique.

Casky's 447 mapped skills detect the attack patterns behind this vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Reconnaissance), TA0043 (Reconnaissance for credential access), and TA0002 (Execution). Practitioners using Casky would identify detection opportunities across multiple stages: initial reconnaissance of GeoVision devices and their firmware versions, credential harvesting or reuse targeting administrative accounts, and the execution phase where shell metacharacters (command separators, redirection operators, subshells) appear in PPPoE configuration fields. Claude's extended reasoning would correlate suspicious patterns—such as unusual characters in network device configuration logs, unexpected command execution contexts in device telemetry, or privilege escalation from authenticated user to root within camera firmware processes—and surface them as high-confidence indicators of this specific exploitation chain, allowing security teams to proactively hunt for compromised cameras and lock down administrative access controls.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88273.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-88273

Casky has 447 skills that investigate the attack patterns behind CVE-2026-88273. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn