EUVD-2026-27546
GHSA-94pq-gp68-xccr
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.
AnalysisAI
Remote code execution in GeoVision GV-ASWeb 6.2.0 allows authenticated users with System Setting permissions to execute arbitrary commands by bypassing frontend restrictions through crafted HTTP POST requests to the ASWebCommon.srf backend endpoint. This authenticated network-accessible vulnerability achieves full system compromise (confidentiality, integrity, and availability impact) with low attack complexity. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all GeoVision GV-ASWeb 6.2.0 instances and verify current user accounts with System Setting permissions. Within 7 days: Implement network segmentation to restrict administrative access to the ASWebCommon.srf endpoint, require multi-factor authentication for all System Setting accounts, and audit recent POST requests to this endpoint for suspicious activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today