GeoVision GV-ASManager CVE-2026-108983

Exploitation targets the GV-ASmanager web server component (GeoWebServer.exe) on its default connection ports, so the condition is that this web service is network-reachable from the attacker - the typical deployment for a centrally managed access-control server. Per the CVSS vector (PR:N, UI:N), no authentication or user interaction is required, and AC:L indicates no special timing or configuration prerequisites. The primary limiting factor is exposure: risk is contained where the GeoWebServer management interface is restricted to an internal/management network rather than exposed to untrusted networks. The exact vulnerable parameter, endpoint, and affected version range are not specified in the available data and should be confirmed against the GeoVision advisory.

Multiple signals point to high priority but with significant data gaps. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full C:H/I:H/A:H impact, consistent with CWE-78 OS command injection yielding code execution - hence the 9.8 base score. EPSS is not provided, the CVE is NOT listed in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description is extremely thin ('a vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe') and does not actually describe the injection mechanism, so the CWE-78 classification and full-impact claim rest on the tags and CVSS vector rather than a detailed vendor writeup - verify with the GeoVision advisory. Net: treat as a real high-severity issue for GV-ASmanager operators because unauthenticated RCE on a management web service is serious, but note that real-world exploitation probability is unquantified (no EPSS/KEV/POC) and the affected product has a limited deployment footprint, which caps aggregate risk relative to a mass-market product.

An attacker with network access to the GV-ASmanager web interface (GeoWebServer.exe) sends a crafted request to a default-listening connection port, injecting OS commands that the server executes without authentication. This yields command execution in the context of the web server process, enabling full compromise of the access-control management host. No public proof-of-concept is currently referenced, and the low attack complexity (AC:L) means exploitation would be straightforward once the injection point is known.