CVE Intelligence
Analysis AI-assisted

CVE-2026-12849: GeoVision GV-I/O Box 4E OS Command Injection in libNetSetObj.so

Multiple OS command injection flaws in the libNetSetObj.so library of GeoVision GV-I/O Box 4E 2.09 may allow command execution through crafted network input. The record rates the issue critical with a CVSS 3.1 base score of 9.1, but it lists no affected version range and no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes OS command injection flaws in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E, version 2.09. This library handles network configuration on the device. The detailed function builds a shell command from a netmask value without sanitization. According to the record, the function is reachable through the DVRSearch service and the Network.cgi endpoint.

Impact

  • The record states that a specially crafted network packet can lead to command execution on the device.
  • The CVSS 3.1 base score of 9.1 (critical) reflects high confidentiality, integrity and availability impact with scope change.
  • The vector in the record requires high privileges (PR:H), which may limit who can trigger the flaw. See the limitations section.

Affected products and versions

  • Product named in the record: GeoVision GV-I/O Box 4E, version 2.09.
  • The record's affected list is empty, so the full range of affected versions is unknown.
  • The record lists no fixed version. The absence of a listed fix does not mean that no fix exists.

Exploitation status

The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Check the vendor security page for firmware updates: GeoVision cyber security.
  • Review the research report for technical context: Talos TALOS-2026-2379.
  • Restrict network access to discovery and configuration services. Place the device on an isolated segment and keep it away from untrusted networks.
  • Limit access to web configuration endpoints to trusted administrators.
  • Inventory all GV-I/O Box 4E devices and record their firmware versions.

Detection guidance

  • Monitor network traffic to the device for requests to discovery and configuration services from untrusted sources.
  • Review device logs, where available, for unexpected changes to network configuration.
  • Alert on unusual outbound connections originating from the device.

Limitations of the available information

  • The record describes multiple flaws but details only one function, so the number of distinct vulnerabilities is unknown.
  • The affected version range, fixed version and vendor patch status are not in the record.
  • EPSS and SSVC data are unavailable.
  • The description refers to triggering by a network request, while the CVSS vector indicates high privileges are required. The actual preconditions are unknown.

Frequently asked questions

Is CVE-2026-12849 being actively exploited?

The record shows the CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record names GeoVision GV-I/O Box 4E version 2.09, but the affected version list is empty, so the full range is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.