CVE-2026-12486: GeoVision GV-I/O Box 4E OS Command Injection in libNetSetObj.so
CVE-2026-12486 describes multiple OS command injection flaws in the libNetSetObj.so library of GeoVision GV-I/O Box 4E 2.09, which can be reached through network requests. The CVSS 3.1 score of 9.1 comes from the CNA, and the weakness is classified as CWE-78. The record shows no CISA KEV listing, no EPSS data, and no affected or fixed version information.
Overview
CVE-2026-12486 describes OS command injection vulnerabilities in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09. According to the record, this library is used by several binaries on the device to configure the network stack, including starting and stopping services and setting IP, netmask, gateway and DNS values. The record describes a function that builds a network interface configuration command from an IP address value without sanitization, which matches the classic command injection weakness classified as CWE-78.
Impact
- The record links the flaw to command execution on the device triggered by a crafted network request.
- The CNA-provided CVSS 3.1 vector rates confidentiality, integrity and availability impacts as high, with scope marked as changed.
- Successful exploitation would let an attacker run operating system commands with the privileges of the affected component. This is an inference, because the record does not state the privilege level obtained.
Affected products and versions
- GeoVision GV-I/O Box 4E, version 2.09, as stated in the record.
- The record does not list affected version ranges or fixed versions. The absence of a fixed version in the record does not mean that no fix exists.
Exploitation status
The record shows the vulnerability is not listed in the CISA KEV catalog, so active exploitation is not reported there. No confirmed exploitation appears in the sources consulted for this analysis. EPSS data is not available in the record.
Remediation and mitigation
- Check the vendor security page for guidance: GeoVision cyber security page.
- Inventory all GV-I/O Box 4E devices and confirm their firmware version.
- Restrict network access to device management and discovery interfaces to trusted segments, since the record states the affected function is reachable from a network-exposed service and a web endpoint.
- Monitor vendor communications and apply official updates once they are published and validated in your environment.
Detection guidance
- Review device logs and network traffic for unexpected requests to management, discovery and configuration endpoints.
- Watch for unexpected changes to network interface settings, such as IP, netmask, gateway or DNS values, on the device.
- Investigate unexplained device restarts or configuration changes as possible indicators of compromise.
Limitations of the available information
- The record describes multiple vulnerabilities but presents technical detail for only one function.
- The CVSS vector lists high privileges required, while the description refers to a network request. The authentication requirement is not stated explicitly.
- The record contains no patch information, fixed versions or affected version ranges.
- This analysis relies on the CVE record and the two listed references. The Talos report content was not included in the record text.
Frequently asked questions
What is CVE-2026-12486?
It is a set of OS command injection vulnerabilities in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09, classified as CWE-78.
Is this vulnerability known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version available?
The record does not list fixed versions or patches. Check the vendor security page and treat the absence of data as unknown rather than as proof that no fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.