A flaw in the Notification Settings of GeoVision GV-ASWeb 6.2.0 allows an authenticated user with System Setting permissions to forge an HTTP POST request to the ASWebCommon.srf backend endpoint, which bypasses frontend restrictions and lets the attacker execute arbitrary commands on the server. The vulnerability is categorized as CWE-94, indicating code injection that can lead to full control over the affected system.

The affected product is GeoVision Inc.'s GV-ASWeb (ASManager) version 6.2.0 running on Windows platforms. Version 6.3.0 contains the remediation.

The CVSS score of 8.8 indicates a high severity level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication and specific System Setting permissions, meaning the attack surface is limited to privileged users. However, once compromised, the attacker can execute arbitrary commands on the server, granting complete compromise of confidentiality, integrity, and availability. The exploitation path is straightforward for an authenticated user, making it a noticeable risk for organizations that rely on GV-ASWeb.