Is CVE-2026-12850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12850 being exploited in the wild.

How severe is CVE-2026-12850?

Critical severity, with a CVSS score of 9.1, published 24 June 2026.

Is there a fix for CVE-2026-12850?

A patch was published on 2026-04-28: Vendor patch release (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12850 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12850?

Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12850: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

CVE-2026-12850 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E, a device used to control industrial inputs and relays over a network, contains a critical security flaw in its network configuration library. An attacker can exploit this to take full control of the device by injecting malicious commands through network requests. This could allow an unauthorized user to disrupt operations, manipulate connected hardware, or use the device as a foothold in the corporate network.

Technologies: Geovision GV-I/O Box 4E. Vendors: Geovision.

Quick answers

Is CVE-2026-12850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12850 being exploited in the wild.
How severe is CVE-2026-12850?: Critical severity, with a CVSS score of 9.1, published 24 June 2026.
Which products and versions are affected?: Geovision GV-I/O Box 4E 2.09.
Is there a fix for CVE-2026-12850?: A patch was published on 2026-04-28: Vendor patch release (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12850 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12850?: Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple OS command injection vulnerabilities exist within the `libNetSetObj.so` library of the GeoVision GV-I/O Box 4E. Specifically, the `CNetSetObj::m_F_n_Set_Gate_way` function fails to sanitize the gateway address string before passing it to a `system()` call via `sprintf`. This vulnerability is reachable via the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. An attacker with high privileges can send a crafted network request to execute arbitrary shell commands with the privileges of the affected process. The vendor has released version 2.12 to address these issues.

Affected products

GeoVision GV-I/O Box 4E 2.09

Timeline

2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
2026-04-28: patched: Vendor patch release (v2.12)
2026-06-24: advisory: Public advisory and CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.