# CVE-2026-12849: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

Source: https://junglewise.ai/threats/cve-2026-12849-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12849 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E, an industrial device used to manage electrical inputs and relays over a network, contains multiple security flaws that allow an attacker to take full control of the system. By sending a specially crafted network request to the device's configuration settings, an attacker can execute unauthorized system commands. This could lead to a complete shutdown of the device, manipulation of connected hardware, or a foothold for further attacks on the corporate network.

Technologies: [Geovision GV-I/O Box 4E](https://junglewise.ai/threats/technologies/gv-i-o-box-4e). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12849 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12849 being exploited in the wild.

**How severe is CVE-2026-12849?** Critical severity, with a CVSS score of 9.1, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-I/O Box 4E 2.09.

**Is there a fix for CVE-2026-12849?** A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12849 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12849?** Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple OS command injection vulnerabilities exist in the 'libNetSetObj.so' library of GeoVision GV-I/O Box 4E firmware version 2.09. The root cause is a failure to sanitize user-supplied input (such as IP addresses, netmasks, and gateways) before passing it to the 'system()' function via 'sprintf()'. Specifically, the 'CNetSetObj::m_F_n_Set_Net_Mask' function is vulnerable. These flaws are reachable via the network-exposed 'DVRSearch' service and the 'Network.cgi' web endpoint. While the CVSS vector indicates high privileges are required, an attacker who can reach these interfaces can achieve full root-level command execution on the underlying Linux operating system. A patch is available in version 2.12.

## Affected products

- GeoVision GV-I/O Box 4E 2.09

## Timeline

- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware patch (v2.12)
- 2026-06-24: advisory: Public advisory and CVE assignment

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12851-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12850-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch DNS field](https://junglewise.ai/threats/cve-2026-12848-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-dns-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch gateway field](https://junglewise.ai/threats/cve-2026-12847-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-gateway-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch net_mask field](https://junglewise.ai/threats/cve-2026-12846-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-net-mask)