A flaw exists in GeoVision Inc.’s GV‑ASManager Web Server that allows an unauthenticated attacker to inject commands through default connection ports accessed by the GeoWebServer.exe process. The vulnerability permits the execution of arbitrary system commands as the web server user, leading to full remote code execution. It is classified as CWE‑78, indicating a lack of proper input validation for operating system command execution arguments.

The affected products are GeoVision Inc.’s GV‑ASManager software on Windows, specifically versions 6.3.0 and 6.4.0. The flaw resides in the web server component that listens on default ports, meaning any system hosting these versions without additional protection could be exposed.

The CVSS score of 9.8 points to a severe risk with high impact on confidentiality, integrity, and availability. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk; the vulnerability’s severity suggests it could be actively exploited by attackers with access to the web interface. The likely attack vector is remote access over the vulnerable default ports, allowing an attacker to craft malicious requests that the server will execute as shell commands.