Threat database

An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability. When interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the "obscurity" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.

CVE-2026-42363 is a critical vulnerability in GeoVision GV-IP Device Utility 9.0.5 where device authentication credentials are insufficiently protected. The utility broadcasts encrypted username and password credentials over UDP using a weak encryption scheme derived from Blowfish, but the symmetric key is included in the same packet. This reliance on security through obscurity allows an attacker on the same LAN to capture broadcast packets, decrypt the credentials, and gain full control over the device configuration, including changing IP addresses or resetting to factory defaults. No official patch or remediation guidance is currently available.

CVE-2026-4606 is a critical local privilege escalation vulnerability in GeoVision's GV-Edge Recording Manager (ERM) version 2.3.1. The application improperly runs components with SYSTEM-level privileges, including Windows file dialogs invoked by functions like 'Import Data'. This allows any local user to execute actions with full SYSTEM privileges, enabling modification or deletion of protected system files. The vulnerability arises because ERM creates a Windows service running as LocalSystem and spawns processes under this context rather than the logged-in user's security context. Exploitation requires local access but no authentication or user interaction. This flaw can lead to full system compromise, making it a severe threat to organizations using this software. No known exploits are currently reported in the wild. Immediate patching or mitigation is critical to prevent potential attacks.

EPSS 0.4%VulnerabilityGeoVision#cwe-250United States+9

Multiple GeoVision devices have an OS command injection vulnerability (CVE-2024-6047) that allows remote, unauthenticated attackers to execute arbitrary system commands. The vulnerability is critical with a CVSS score of 9.8 and is known to be exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.

Multiple GeoVision devices are affected by a critical OS command injection vulnerability (CVE-2024-11120) that allows remote, unauthenticated attackers to execute arbitrary system commands. The affected devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has a high CVSS score of 9.8 and is known to be exploited in the wild.

GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394.

EPSS 0.6%VulnerabilityGeoVision#cwe-862United States+9