This vulnerability involves multiple OS command injection flaws in the libNetSetObj.so component of GeoVision GV-I/O Box 4E version 2.09. The function CNetSetObj::m_F_n_Set_Net_Mask takes a netmask address string from user input without sanitization and constructs a command string passed to the system() call. This allows an attacker to execute arbitrary commands on the device by sending specially crafted network requests to the network-exposed DVRSearch service or the Network.cgi endpoint. The CVSS 3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges and network access to execute arbitrary OS commands on the affected device, potentially leading to full system compromise including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected services (DVRSearch and Network.cgi) to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted networks. Follow vendor guidance once published.