Executive brief
GeoVision GV-I/O Box 4E, an industrial device used to manage electrical inputs and relays over a network, contains multiple security flaws that allow an attacker to take full control of the system. By sending a specially crafted network request to the device's configuration settings, an attacker can execute unauthorized system commands. This could lead to a complete shutdown of the device, manipulation of connected hardware, or a foothold for further attacks on the corporate network.
Technical details
Multiple OS command injection vulnerabilities exist in the 'libNetSetObj.so' library of GeoVision GV-I/O Box 4E firmware version 2.09. The root cause is a failure to sanitize user-supplied input (such as IP addresses, netmasks, and gateways) before passing it to the 'system()' function via 'sprintf()'. Specifically, the 'CNetSetObj::m_F_n_Set_Net_Mask' function is vulnerable. These flaws are reachable via the network-exposed 'DVRSearch' service and the 'Network.cgi' web endpoint. While the CVSS vector indicates high privileges are required, an attacker who can reach these interfaces can achieve full root-level command execution on the underlying Linux operating system. A patch is available in version 2.12.
Affected products
- GeoVision GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware patch (v2.12)
- 2026-06-24: advisory: Public advisory and CVE assignment