CVE Intelligence
Analysis AI-assisted

CVE-2026-12851: GeoVision GV-I/O Box 4E OS command injection in libNetSetObj.so

CVE-2026-12851 describes multiple OS command injection flaws in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09, where configuration values such as DNS addresses reach a shell command without sanitization. The CNA assigns a CVSS 3.1 base score of 9.1 (critical) and maps the issue to CWE-78. The record shows no KEV listing, no confirmed exploitation in the sources consulted, and no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12851 covers multiple OS command injection flaws in the libNetSetObj.so library used by the GeoVision GV-I/O Box 4E 2.09 to configure the device network stack. The described function CNetSetObj::m_F_n_Set_DNS_Addr passes DNS server values to a shell-invoked command without sanitization.

Impact

The record maps the issue to CWE-78 (OS Command Injection). The CNA assigns a CVSS 3.1 base score of 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, which indicates network attack vector, low complexity, no user interaction, changed scope and high impact on confidentiality, integrity and availability. The vector also requires high privileges (PR:H), which should be weighed against the description of a network-triggered request.

Affected products and versions

  • Product: GeoVision GV-I/O Box 4E, version 2.09 as stated in the description.
  • The structured data of the record lists no affected version ranges.
  • Network-reachable components named in the advisory: the DVRSearch service and the Network.cgi endpoint.

Exploitation status

The KEV flag in the record is false, so this CVE is not listed as actively exploited in the sources consulted. The record contains no EPSS value, no SSVC data and no ransomware association. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Check the GeoVision cyber security page for vendor guidance and any firmware update for the GV-I/O Box 4E.
  • Until a vendor fix is confirmed, restrict access to device management and configuration interfaces to trusted administrative networks.
  • Do not expose the device, the DVRSearch service or the Network.cgi endpoint directly to the internet.
  • Review network configuration values on the device, including DNS settings, for unexpected entries.
  • Review the Talos vulnerability report TALOS-2026-2379 for the researcher's technical details and recommendations.

Detection guidance

  • Monitor for unexpected changes to DNS resolver configuration on the device.
  • Log and review requests to the Network.cgi endpoint and traffic to the DVRSearch service from untrusted sources.
  • Alert on device processes spawning unexpected shell activity, where such telemetry is available.

Limitations of the available information

The record contains no fixed versions, no vendor-confirmed patch, no affected version ranges, no EPSS or SSVC data, and no KEV details beyond a negative listing. Its source status is Deferred. The exact preconditions for triggering the flaw are known only from the description and the CVSS vector.

Frequently asked questions

Is CVE-2026-12851 known to be actively exploited?

The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted. The absence of exploitation data is not proof that exploitation has not occurred.

Is there a fixed version for the GeoVision GV-I/O Box 4E?

The record lists no fixed version. Check the GeoVision cyber security page for vendor guidance, since a missing fixed version in the record does not mean no fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.