Which versions of Gv Edge Recording Manager are affected by CVE-2026-4606?

CVE-2026-4606 presents critical security risk rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

How to fix or mitigate CVE-2026-4606?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Gv Edge Recording Manager CVE-2026-4606

Q: What is the CVSS score of CVE-2026-4606?

CVE-2026-4606 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2026-14346 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-03-23 GV

Privilege Escalation Microsoft Gv Edge Recording Manager Geovision

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 01:30 euvd

EUVD-2026-14346

Analysis Generated

Mar 23, 2026 - 01:30 vuln.today

CVE Published

Mar 23, 2026 - 01:05 nvd

CRITICAL 10.0

DescriptionCVE.org

GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.

During installation, ERM creates a Windows service that runs under the LocalSystem account.

When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.

Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.

Any ERM function invoking Windows file open/save dialogs exposes the same risk.

This vulnerability allows local privilege escalation and may result in full system compromise.

AnalysisAI

GV Edge Recording Manager (ERM) v2.3.1 improperly executes application components with SYSTEM-level privileges, allowing any local user to escalate privileges and gain full control of the operating system. The vulnerability stems from the Windows service running under the LocalSystem account and spawning child processes with elevated privileges, particularly when file dialogs are invoked during operations like data import. This is a local privilege escalation vulnerability with high real-world risk due to the ease of exploitation and the severity of the impact.

Technical ContextAI

The vulnerability is rooted in improper privilege management in GV Edge Recording Manager, specifically affecting the Windows service architecture and process spawning mechanisms. As identified by CWE-250 (Execution with Unnecessary Privileges), the application violates the principle of least privilege by running application functionality under the LocalSystem account rather than restricting execution to the user's security context. The CPE cpe:2.3:a:geovision:gv-edge_recording_manager:*:*:*:*:*:*:*:* identifies the affected product line. When the ERM application launches, it spawns child processes that inherit SYSTEM privileges. The file dialog functionality in Windows, when invoked with SYSTEM privileges, operates outside normal access control boundaries, allowing the unprivileged user to interact with protected system files and directories. This is a Windows-specific vulnerability leveraging the way Windows service contexts propagate privileges to spawned processes.

RemediationAI

Upgrade GV Edge Recording Manager to a patched version released by GeoVision that addresses the privilege escalation vulnerability; consult the vendor advisory at https://www.geovision.com.tw/cyber_security.php for the specific patched version number and deployment instructions. As an interim measure, restrict local system access to trusted administrators only, disable or uninstall ERM if not actively required, and monitor for suspicious file system modifications originating from the ERM service account. Apply Windows security updates and run antimalware scans to detect any prior exploitation.