Is CVE-2026-12486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12486 being exploited in the wild.

How severe is CVE-2026-12486?

Critical severity, with a CVSS score of 9.1, published 24 June 2026.

Is there a fix for CVE-2026-12486?

A patch was published on 2026-04-28: Vendor patch release (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12486 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12486?

Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12486: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

CVE-2026-12486 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E is an industrial networking device used to manage physical inputs and relays over Ethernet. Multiple security flaws allow an attacker to inject malicious commands into the device's network configuration settings. If exploited, an attacker could gain full control over the device, potentially disrupting physical operations or using the device as a foothold to access other parts of the corporate network.

Technologies: Geovision GV-I/O Box 4E. Vendors: Geovision.

Quick answers

Is CVE-2026-12486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12486 being exploited in the wild.
How severe is CVE-2026-12486?: Critical severity, with a CVSS score of 9.1, published 24 June 2026.
Which products and versions are affected?: Geovision GV-I/O Box 4E 2.09.
Is there a fix for CVE-2026-12486?: A patch was published on 2026-04-28: Vendor patch release (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12486 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12486?: Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple OS command injection vulnerabilities exist within the `libNetSetObj.so` library, specifically in functions responsible for network configuration such as `CNetSetObj::m_F_n_Set_IP_Addr`, `m_F_n_Set_Net_Mask`, `m_F_n_Set_Gate_way`, and `m_F_n_Set_DNS_Addr`. The root cause is the use of the `system()` function on unsanitized user input provided through IP address, netmask, gateway, or DNS fields. These functions are reachable via the network-exposed `DVRSearch` service and the `Network.cgi` web endpoint. An attacker with high privileges can execute arbitrary shell commands with the permissions of the affected process. A patch is available in firmware version 2.12.

Affected products

GeoVision GV-I/O Box 4E 2.09

Timeline

2026-04-21: disclosed: Initial vendor contact and disclosure
2026-04-28: patched: Vendor patch release (v2.12)
2026-06-24: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.