CVE Intelligence
Analysis AI-assisted

CVE-2026-12850: GeoVision GV-I/O Box 4E OS Command Injection in libNetSetObj.so

GeoVision GV-I/O Box 4E 2.09 contains OS command injection flaws in the libNetSetObj.so library, where values received over the network are passed without sanitization into system calls. The record describes a gateway-address handler reachable through the DVRSearch service and the Network.cgi endpoint, and the CNA rates it critical with a CVSS 3.1 base score of 9.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes OS command injection vulnerabilities in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09. This library configures the device network stack, including services, IP address, netmask, gateway and DNS. According to the description, a specially crafted network request can lead to command execution. The described gateway handler builds a routing command from an unsanitized value and passes it to a system call, which matches the OS command injection weakness class (CWE-78).

Impact

  • The CNA-provided CVSS 3.1 base score is 9.1 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
  • The vector rates confidentiality, integrity and availability impact as high, with a changed scope.
  • If exploited as described, command execution on the device would let an attacker affect the device configuration and the services it runs. The exact outcome depends on device privileges, which the record does not document.

Affected products and versions

  • The description names the GeoVision GV-I/O Box 4E 2.09 as affected.
  • The structured affected-product list in the record is empty, so the full range of affected versions is unknown.
  • The description refers to multiple vulnerabilities, but only one function (the gateway handler) is detailed.

Exploitation status

The KEV catalog entry is not listed, and no EPSS score is available in the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version. Check the vendor security page GeoVision cyber security for updates, advisories or firmware for the GV-I/O Box 4E.
  • Restrict network access to the device management interfaces and to the DVRSearch and Network.cgi services. Allow access only from trusted administrative networks.
  • Place these devices in segmented networks separated from general user and internet-facing segments.
  • Disable services that are not required, where the product allows it.
  • Review the device for unexpected configuration changes after any suspected access.

Detection guidance

  • Monitor traffic to the device's management and DVRSearch interfaces, especially from sources outside expected administrative ranges.
  • Track changes to the device network configuration, including default gateway and routing entries, and alert on unexpected modifications.
  • Where logging is available, review device logs for unusual requests to configuration endpoints.
  • These indicators are high-level and depend on the logging the device actually provides.

Limitations of the available information

  • The record does not provide a fixed version, a patch or a list of affected firmware builds.
  • The EPSS score and SSVC data are not available.
  • The source status is Deferred, and the record is based on the CNA and NVD entries.
  • The CVSS vector indicates high privileges are required (PR:H), while the description refers to a network request without mentioning authentication. The record does not resolve this difference.
  • The referenced Talos report and vendor page were not fully reviewed here beyond what the record contains.

Frequently asked questions

What is CVE-2026-12850?

It is a set of OS command injection flaws in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09, according to the record. The described gateway handler passes unsanitized input to a system call.

Is this vulnerability known to be actively exploited?

The vulnerability is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. Check the vendor page at geovision.com.tw for current guidance on the GV-I/O Box 4E.

What should administrators do now?

Restrict network access to the device's management and DVRSearch/Network.cgi interfaces, segment the device from general networks, disable unneeded services, and monitor for unexpected configuration changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.