EUVD-2026-52639
GHSA-f7mr-6525-7qmf
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local vector with low-privilege write access required and separate user-triggered application launch needed; full CIA impact upon DLL load.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
2DescriptionCVE.org
A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legitimate library, the malicious code is loaded and executed under the security privileges of the GV-ASManager process.
AnalysisAI
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
Technical ContextAI
CWE-428 (Unquoted Search Path or Element) describes a class of vulnerabilities where an application resolves library or executable names by traversing an ordered list of directories without ensuring the source is authoritative. On Windows, DLL search order includes directories such as the application directory, the current working directory, and entries in the system PATH; if any of these are writable by a low-privileged user, a malicious DLL placed there with a target filename will be loaded before the legitimate library. GV-ASManager (CPE: cpe:2.3:a:geovision_inc.:gv-asmanager:*:*:*:*:*:*:*:*) is GeoVision Inc.'s access management platform used in physical security deployments such as access control and surveillance environments. The wildcard version field in the CPE indicates no specific version has been designated as unaffected, suggesting all releases may carry this flaw until a vendor patch is applied.
RemediationAI
Consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php for an official patch or updated installer; no specific fixed version number has been confirmed from available data. As an immediate compensating control, audit and restrict write permissions on all directories included in GV-ASManager's DLL resolution path - particularly the application installation directory, the current working directory at launch, and any user-writable entries in the system PATH - to administrators only; note this may interfere with application self-update mechanisms that write to those locations. Enable Windows Safe DLL Search Mode via the SafeDllSearchMode registry value (HKLM\System\CurrentControlSet\Control\Session Manager) to reduce but not eliminate DLL search order exposure. Configure GV-ASManager to run under a dedicated least-privilege service account so that even a successful DLL injection is bounded in what system resources the attacker's code can access. Monitor for unexpected DLL files appearing in the application directory using file integrity monitoring tools.
More in Gv Asmanager
View allSame weakness CWE-428 – Unquoted Search Path or Element
View allShare
External POC / Exploit Code
Leaving vuln.today