Executive brief
GeoVision GV-I/O Box 4E is an industrial networking device used to manage physical inputs and relays over Ethernet. Multiple security flaws allow an attacker to inject malicious commands into the device's network configuration settings. If exploited, an attacker could gain full control over the device, potentially disrupting physical operations or using the device as a foothold to access other parts of the corporate network.
Technical details
Multiple OS command injection vulnerabilities exist within the `libNetSetObj.so` library, specifically in functions responsible for network configuration such as `CNetSetObj::m_F_n_Set_IP_Addr`, `m_F_n_Set_Net_Mask`, `m_F_n_Set_Gate_way`, and `m_F_n_Set_DNS_Addr`. The root cause is the use of the `system()` function on unsanitized user input provided through IP address, netmask, gateway, or DNS fields. These functions are reachable via the network-exposed `DVRSearch` service and the `Network.cgi` web endpoint. An attacker with high privileges can execute arbitrary shell commands with the permissions of the affected process. A patch is available in firmware version 2.12.
Affected products
- GeoVision GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure
- 2026-04-28: patched: Vendor patch release (v2.12)
- 2026-06-24: advisory: NVD publication date