# CVE-2026-12851: GeoVision GV-I/O Box 4E command injection in libNetSetObj.so

Source: https://junglewise.ai/threats/cve-2026-12851-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12851 · Severity: critical · CVSS 9.1 · Published 2026-06-24

GeoVision GV-I/O Box 4E is an Ethernet-based device used to control physical inputs and relays for security and automation systems. A security flaw in its network configuration library allows an attacker to take full control of the device by sending a malicious network request. This could lead to unauthorized manipulation of physical security hardware or a complete service outage.

Technologies: [Geovision GV-I/O Box 4E](https://junglewise.ai/threats/technologies/gv-i-o-box-4e). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12851 being exploited in the wild.

**How severe is CVE-2026-12851?** Critical severity, with a CVSS score of 9.1, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-I/O Box 4E 2.09.

**Is there a fix for CVE-2026-12851?** A patch was published on 2026-04-28: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12851 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12851?** Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple OS command injection vulnerabilities exist within the `libNetSetObj.so` library of the GeoVision GV-I/O Box 4E firmware version 2.09. The root cause is a failure to sanitize user-supplied input in functions such as `CNetSetObj::m_F_n_Set_DNS_Addr`, `m_F_n_Set_IP_Addr`, `m_F_n_Set_Net_Mask`, and `m_F_n_Set_Gate_way` before passing them to the `system()` function. These functions are reachable via the network-exposed `DVRSearch` service and the `Network.cgi` web endpoint. An attacker with high privileges can exploit these flaws by sending specially crafted network packets to execute arbitrary system commands with root privileges. A patch was released by the vendor on 2026-04-28 (likely version 2.12).

## Affected products

- GeoVision GV-I/O Box 4E 2.09

## Timeline

- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor patch release
- 2026-06-23: advisory: Cisco Talos advisory published
- 2026-06-24: advisory: NVD publication date

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12850-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12849-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch DNS field](https://junglewise.ai/threats/cve-2026-12848-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-dns-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch gateway field](https://junglewise.ai/threats/cve-2026-12847-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-gateway-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch net_mask field](https://junglewise.ai/threats/cve-2026-12846-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-net-mask)