EUVD-2026-38650
GHSA-4rgm-6fq6-4x7q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable services (AV:N), trivial sprintf-to-system primitive (AC:L), requires admin auth to invoke the config path (PR:H), command execution escapes service context (S:C) with full CIA impact.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
1DescriptionCVE.org
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.
libNetSetObj.so is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)
CNetSetObj::m_F_n_Set_IP_Addr command injection
The following function takes a string as an ip address, performs no sanitization and calls system. This is a classic command injection vulnerability. The function is reachable from both the network-exposed DVRSearch service and the Network.cgi endpoint.
int __fastcall CNetSetObj::m_F_n_Set_IP_Addr(const char **this, char *ip_addr)
{
bool v2; // zf
char v4[72]; // [sp+0h] [bp-48h] BYREF
v2 = *this == 0;
if ( *this )
v2 = ip_addr == 0;
if ( v2 )
return 0;
sprintf(v4, "/sbin/ifconfig %s %s", *this, ip_addr); // attacker controlled ip address
system(v4);
return 1;
}
AnalysisAI
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the libNetSetObj.so library via the DVRSearch service or Network.cgi endpoint. The flaw stems from unsanitized attacker-controlled IP address input passed directly to system() in CNetSetObj::m_F_n_Set_IP_Addr. No public exploit identified at time of analysis, though Talos Intelligence disclosed the issue with technical detail (TALOS-2026-2379).
Technical ContextAI
The affected component is libNetSetObj.so, a shared library used across multiple binaries on the GeoVision GV-I/O Box 4E device (cpe:2.3:a:geovision_inc.:gv-i/o_box_4e) to manage network stack configuration including IP, netmask, gateway, and DNS settings. The root cause aligns with CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the vulnerable function builds an ifconfig command string with sprintf using attacker-controlled input and invokes system() directly, with no input validation, escaping, or use of safer exec-family APIs. The reachable surfaces include the network-exposed DVRSearch service and the Network.cgi web endpoint, both common attack surfaces on IP-based GeoVision I/O appliances.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data; defenders should monitor https://www.geovision.com.tw/cyber_security.php for a firmware update addressing CVE-2026-12486 and apply the fixed firmware to all GV-I/O Box 4E units as soon as it is published. Until a patched firmware is available, compensating controls include placing the device on an isolated management VLAN with no inbound access from user or internet segments, blocking external access to the DVRSearch service port and the Network.cgi HTTP endpoint at the perimeter and at any upstream switch ACL, and rotating administrative credentials to long unique values to raise the PR:H bar - accepting that credential rotation does not fix the underlying flaw and that segmentation may break remote management workflows that legitimately invoke Network.cgi. Disabling the DVRSearch discovery service if not required reduces one of the two reachable sinks but may break automatic device discovery in management software.
More in Gv I O Box 4E
View allStack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on th
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute ar
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network servic
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today