This vulnerability involves multiple OS command injection flaws in the libNetSetObj.so component of GeoVision GV-I/O Box 4E version 2.09. The function CNetSetObj::m_F_n_Set_IP_Addr takes an IP address string without sanitization and uses it in a system call via sprintf and system("/sbin/ifconfig ..."), enabling command injection. The vulnerable function is reachable through the network-exposed DVRSearch service and the Network.cgi endpoint, allowing remote attackers to execute arbitrary commands on the device by sending crafted network requests.

Successful exploitation allows an attacker with network access and high privileges (PR:H) to execute arbitrary OS commands with the privileges of the affected service, leading to complete compromise of confidentiality, integrity, and availability of the device. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected services (DVRSearch and Network.cgi) to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted networks.