GeoVision GV-ASWeb CVE-2026-7841

Requires valid authentication credentials with specifically System Setting permissions in GeoVision GV-ASWeb, not just any authenticated user access. This permission level is typically restricted to security system administrators rather than general operators or viewers. Attack targets the Notification Settings feature accessed via the ASWebCommon.srf backend endpoint. Network access to the GV-ASWeb administrative interface is required (AV:N), but exploitation is limited to environments where the attacker has already obtained administrative credentials or where System Setting permissions are over-provisioned to users who should not have configuration authority. Default GV-ASWeb deployments may not expose the management interface to untrusted networks, further limiting attack surface in properly segmented environments.

The CVSS 3.1 score of 8.8 (High) accurately reflects the technical severity with network attack vector (AV:N), low complexity (AC:L), and complete CIA triad impact (C:H/I:H/A:H). However, real-world risk is substantially mitigated by the PR:L (low privileges required) authentication barrier and the specific requirement for System Setting permissions, which are typically restricted to security administrators rather than general users. The vulnerability cannot be exploited by unauthenticated attackers or standard authenticated users without elevated permissions. EPSS exploitation probability data is not available in the input, preventing quantitative assessment of exploitation likelihood. No CISA KEV listing exists, indicating no confirmed active exploitation. No public POC is identified in available references. The single vendor advisory reference suggests controlled disclosure rather than widespread public attention. SSVC framework assessment: exploitation status is none confirmed, automation potential is high given network access and low complexity once authenticated, technical impact is total system compromise within the application's privilege context. Priority should focus on environments where GV-ASWeb administrative access is broadly distributed or where insider threat risk is elevated, rather than treating as an internet-wide critical emergency.

An authenticated attacker with System Setting permissions (such as a malicious insider, compromised administrator account, or attacker who has escalated privileges through separate vulnerabilities) crafts a malicious HTTP POST request to the ASWebCommon.srf backend endpoint within the Notification Settings functionality. By manipulating parameters to include command injection payloads and bypassing frontend validation that would normally restrict input, the attacker achieves arbitrary command execution on the GV-ASWeb server with the privileges of the web application process, potentially gaining full control over the access control management system, extracting surveillance data, manipulating access permissions, or pivoting to connected physical security infrastructure.