CVE-2026-12850

GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

View on CVE.org
Published Jun 24, 2026 CVSS 3.1 · 9.1 Critical EPSS 2.7% KEV · Not listed
Description
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.


`libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)


#### CNetSetObj::m_F_n_Set_Gate_way command injection

The following function takes a string as a gatewy address, performs no sanitization on it and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint.





int __fastcall CNetSetObj::m_F_n_Set_Gate_way(const char **this, char *gw, char *dev)

{

char s[324]; // [sp+4h] [bp-144h] BYREF



if ( !dev && !*this || !gw )

return 0;

system("/sbin/route del -net 224.0.0.0 netmask 224.0.0.0");

system("/sbin/route del default ");

if ( dev )

sprintf(s, "/sbin/route add default gw %s dev %s", gw, dev); //attacker controlled gw string

else

sprintf(s, "/sbin/route add default gw %s dev %s", gw, *this); //attacker controlled gw string

system(s);

sprintf(s, "/sbin/route add -net 224.0.0.0 netmask 224.0.0.0 gw %s dev %s", gw, *this); //attacker controlled gw string

system(s);

return 1;

}

Analysis

AI-generated

Technical impact

The vulnerability arises from unsanitized gateway strings handed to the system() call in the libNetSetObj.so library of GeoVision GV-I/O Box 4E, allowing an attacker to execute arbitrary commands on the device with full privileges. An adversary could modify routing tables, interrupt network services, or install malware, effectively gaining remote control over the device.

Affected Systems

GeoVision Inc.’s GV‑I/O Box 4E running firmware version 2.09. The flaw is triggered via the DVRSearch service and the Network.cgi endpoint, which are exposed over the network.

Risk and Exploitability

With a CVSS score of 9.1, the vulnerability is high severity. The EPSS score is 2%, and the issue has not been listed in CISA KEV. It is inferred that the attack vector is network‑exposed, requiring the attacker to reach the device over an accessible interface such as the DVRSearch TCP service or the HTTP endpoint. Successful exploitation grants unrestricted command execution, making the risk significant for any network‑connected deployment.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest GeoVision firmware that fixes the command‑injection flaw.
  • If a patch is not available, restrict or block all inbound traffic to the DVRSearch service and the Network.cgi endpoint from untrusted networks.
  • Continuously monitor device logs for unexpected system command executions or routing changes, and isolate the device from critical infrastructure if necessary.

Generated by OpenCVE AI on June 24, 2026 at 15:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_Gate_way command injection The following function takes a string as a gatewy address, performs no sanitization on it and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. int __fastcall CNetSetObj::m_F_n_Set_Gate_way(const char **this, char *gw, char *dev) { char s[324]; // [sp+4h] [bp-144h] BYREF if ( !dev && !*this || !gw ) return 0; system("/sbin/route del -net 224.0.0.0 netmask 224.0.0.0"); system("/sbin/route del default "); if ( dev ) sprintf(s, "/sbin/route add default gw %s dev %s", gw, dev); //attacker controlled gw string else sprintf(s, "/sbin/route add default gw %s dev %s", gw, *this); //attacker controlled gw string system(s); sprintf(s, "/sbin/route add -net 224.0.0.0 netmask 224.0.0.0 gw %s dev %s", gw, *this); //attacker controlled gw string system(s); return 1; }
Title GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
First Time appeared Geovision Inc.
Geovision Inc. gv-i O Box 4e
Weaknesses CWE-78
CPEs cpe:2.3:a:geovision_inc.:gv-i_o_box_4e:v2.09:*:linux:*:*:*:*:*
cpe:2.3:a:geovision_inc.:gv-i_o_box_4e:v2.12:*:linux:*:*:*:*:*
Vendors & Products Geovision Inc.
Geovision Inc. gv-i O Box 4e
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
GV
Published
Updated
Jun 24, 2026, 12:52 PM
Reserved
Jun 22, 2026, 12:42 AM

View source JSON

Updated
Jun 24, 2026, 12:52 PM

JSON

Status
Deferred
Published
Jun 24, 2026, 5:17 AM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Jun 24, 2026, 3:45 PM

JSON