This vulnerability (CVE-2026-7841) in GeoVision Inc.'s ASManager product version 6.2.0 allows an authenticated user with System Setting permissions to perform remote code execution. The issue arises from improper control of code generation (CWE-94) in the Notification Settings component. By sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint, the attacker can bypass frontend restrictions and execute arbitrary commands on the server. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or official remediation level has been provided by the vendor.

Successful exploitation allows an authenticated user with System Setting permissions to execute arbitrary code on the server hosting GV-ASWeb 6.2.0. This can lead to full compromise of the affected system, including unauthorized access, data manipulation, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 8.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict System Setting permissions to trusted administrators only and monitor for suspicious activity related to HTTP POST requests to the ASWebCommon.srf endpoint. Avoid exposing the management interface to untrusted networks.