# CVE-2026-12486: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

Source: https://junglewise.ai/threats/cve-2026-12486-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12486 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E is an industrial networking device used to manage physical inputs and relays over Ethernet. Multiple security flaws allow an attacker to inject malicious commands into the device's network configuration settings. If exploited, an attacker could gain full control over the device, potentially disrupting physical operations or using the device as a foothold to access other parts of the corporate network.

Technologies: [Geovision GV-I/O Box 4E](https://junglewise.ai/threats/technologies/gv-i-o-box-4e). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12486 being exploited in the wild.

**How severe is CVE-2026-12486?** Critical severity, with a CVSS score of 9.1, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-I/O Box 4E 2.09.

**Is there a fix for CVE-2026-12486?** A patch was published on 2026-04-28: Vendor patch release (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12486 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12486?** Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple OS command injection vulnerabilities exist within the `libNetSetObj.so` library, specifically in functions responsible for network configuration such as `CNetSetObj::m_F_n_Set_IP_Addr`, `m_F_n_Set_Net_Mask`, `m_F_n_Set_Gate_way`, and `m_F_n_Set_DNS_Addr`. The root cause is the use of the `system()` function on unsanitized user input provided through IP address, netmask, gateway, or DNS fields. These functions are reachable via the network-exposed `DVRSearch` service and the `Network.cgi` web endpoint. An attacker with high privileges can execute arbitrary shell commands with the permissions of the affected process. A patch is available in firmware version 2.12.

## Affected products

- GeoVision GV-I/O Box 4E 2.09

## Timeline

- 2026-04-21: disclosed: Initial vendor contact and disclosure
- 2026-04-28: patched: Vendor patch release (v2.12)
- 2026-06-24: advisory: NVD publication date

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12851-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12850-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12849-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch DNS field](https://junglewise.ai/threats/cve-2026-12848-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-dns-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch gateway field](https://junglewise.ai/threats/cve-2026-12847-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-gateway-field)