CVE-2026-12486: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in GeoVision Inc. GV-I/O Box 4E
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_IP_Addr command injection The following function takes a string as an ip address, performs no sanitization and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. int __fastcall CNetSetObj::m_F_n_Set_IP_Addr(const char **this, char *ip_addr) { bool v2; // zf char v4[72]; // [sp+0h] [bp-48h] BYREF v2 = *this == 0; if ( *this ) v2 = ip_addr == 0; if ( v2 ) return 0; sprintf(v4, "/sbin/ifconfig %s %s", *this, ip_addr); // attacker controlled ip address system(v4); return 1; }
AI Analysis
Technical Summary
This vulnerability involves multiple OS command injection flaws in the libNetSetObj.so component of GeoVision GV-I/O Box 4E version 2.09. The function CNetSetObj::m_F_n_Set_IP_Addr takes an IP address string without sanitization and uses it in a system call via sprintf and system("/sbin/ifconfig ..."), enabling command injection. The vulnerable function is reachable through the network-exposed DVRSearch service and the Network.cgi endpoint, allowing remote attackers to execute arbitrary commands on the device by sending crafted network requests.
Potential Impact
Successful exploitation allows an attacker with network access and high privileges (PR:H) to execute arbitrary OS commands with the privileges of the affected service, leading to complete compromise of confidentiality, integrity, and availability of the device. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected services (DVRSearch and Network.cgi) to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted networks.
CVE-2026-12486: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in GeoVision Inc. GV-I/O Box 4E
Description
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_IP_Addr command injection The following function takes a string as an ip address, performs no sanitization and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. int __fastcall CNetSetObj::m_F_n_Set_IP_Addr(const char **this, char *ip_addr) { bool v2; // zf char v4[72]; // [sp+0h] [bp-48h] BYREF v2 = *this == 0; if ( *this ) v2 = ip_addr == 0; if ( v2 ) return 0; sprintf(v4, "/sbin/ifconfig %s %s", *this, ip_addr); // attacker controlled ip address system(v4); return 1; }
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves multiple OS command injection flaws in the libNetSetObj.so component of GeoVision GV-I/O Box 4E version 2.09. The function CNetSetObj::m_F_n_Set_IP_Addr takes an IP address string without sanitization and uses it in a system call via sprintf and system("/sbin/ifconfig ..."), enabling command injection. The vulnerable function is reachable through the network-exposed DVRSearch service and the Network.cgi endpoint, allowing remote attackers to execute arbitrary commands on the device by sending crafted network requests.
Potential Impact
Successful exploitation allows an attacker with network access and high privileges (PR:H) to execute arbitrary OS commands with the privileges of the affected service, leading to complete compromise of confidentiality, integrity, and availability of the device. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected services (DVRSearch and Network.cgi) to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GV
- Date Reserved
- 2026-06-17T03:09:07.610Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3b667deed863c81e4ac192
Added to database: 06/24/2026, 05:09:17 UTC
Last enriched: 06/24/2026, 05:24:31 UTC
Last updated: 08/04/2026, 12:46:10 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.