Is CVE-2026-12849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12849 being exploited in the wild.

How severe is CVE-2026-12849?

Critical severity, with a CVSS score of 9.1, published 24 June 2026.

Is there a fix for CVE-2026-12849?

A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12849 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12849?

Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12849: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

CVE-2026-12849 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E, an industrial device used to manage electrical inputs and relays over a network, contains multiple security flaws that allow an attacker to take full control of the system. By sending a specially crafted network request to the device's configuration settings, an attacker can execute unauthorized system commands. This could lead to a complete shutdown of the device, manipulation of connected hardware, or a foothold for further attacks on the corporate network.

Technologies: Geovision GV-I/O Box 4E. Vendors: Geovision.

Quick answers

Is CVE-2026-12849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12849 being exploited in the wild.
How severe is CVE-2026-12849?: Critical severity, with a CVSS score of 9.1, published 24 June 2026.
Which products and versions are affected?: Geovision GV-I/O Box 4E 2.09.
Is there a fix for CVE-2026-12849?: A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12849 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12849?: Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple OS command injection vulnerabilities exist in the 'libNetSetObj.so' library of GeoVision GV-I/O Box 4E firmware version 2.09. The root cause is a failure to sanitize user-supplied input (such as IP addresses, netmasks, and gateways) before passing it to the 'system()' function via 'sprintf()'. Specifically, the 'CNetSetObj::m_F_n_Set_Net_Mask' function is vulnerable. These flaws are reachable via the network-exposed 'DVRSearch' service and the 'Network.cgi' web endpoint. While the CVSS vector indicates high privileges are required, an attacker who can reach these interfaces can achieve full root-level command execution on the underlying Linux operating system. A patch is available in version 2.12.

Affected products

GeoVision GV-I/O Box 4E 2.09

Timeline

2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
2026-04-28: patched: Vendor released firmware patch (v2.12)
2026-06-24: advisory: Public advisory and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.