PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12486 GeoVision Inc. CVE debrief

CVE-2026-12486 is a critical vulnerability in GeoVision GV-I/O Box 4E 2.09, involving multiple OS command injection vulnerabilities in the libNetSetObj.so library. This library is used by various binaries to configure the network stack. An attacker can exploit this vulnerability by sending a specially crafted network packet to trigger command execution. The vulnerability exists in the CNetSetObj::m_F_n_Set_IP_Addr function, which takes a string as an IP address without sanitization and calls the system function, allowing for classic command injection. This function is reachable from both the network-exposed DVRSearch service and the Network.cgi endpoint. The CVSS score for this vulnerability is 9.1, indicating a critical severity. The CVE was published on 2026-06-24T05:17:26.220Z and modified on 2026-06-25T14:02:35.347Z.

Vendor
GeoVision Inc.
Product
GV-I/O Box 4E
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-24
Original CVE updated
2026-06-25
Advisory published
2026-06-24
Advisory updated
2026-06-25

Who should care

Organizations using GeoVision GV-I/O Box 4E 2.09 should prioritize patching this vulnerability to prevent potential command injection attacks. The vulnerability's critical severity and the availability of exploit vectors make it essential for defenders to take immediate action. Additionally, security teams should review their inventory of affected devices and monitor for any suspicious network activity.

Technical summary

The libNetSetObj.so library in GeoVision GV-I/O Box 4E 2.09 contains multiple OS command injection vulnerabilities. Specifically, the CNetSetObj::m_F_n_Set_IP_Addr function is vulnerable, as it takes an IP address string without proper sanitization and uses it in a system call. This allows attackers to inject commands via specially crafted network packets. The vulnerability is accessible through both the DVRSearch service and the Network.cgi endpoint, increasing the attack surface. The CVSS:3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating a high impact and exploitability.

Defensive priority

This vulnerability has a high defensive priority due to its critical severity and potential for command injection. Defenders should prioritize patching and monitoring affected devices.

Recommended defensive actions

  • Apply patches or updates provided by the vendor to address the vulnerability in libNetSetObj.so.
  • Restrict access to the DVRSearch service and Network.cgi endpoint to minimize exposure.
  • Monitor network activity for suspicious packets that could be used to exploit the vulnerability.
  • Perform thorough inventory checks to identify and update all affected GeoVision GV-I/O Box 4E 2.09 devices.
  • Implement additional security controls, such as network segmentation and intrusion detection systems, to detect and prevent exploitation attempts.

Evidence notes

The CVE-2026-12486 details are based on information from the NVD and CVE.org. The vulnerability was reported by Talos Intelligence and is related to GeoVision's cyber security updates. However, specific details about the vendor and affected products are limited, suggesting a need for further investigation and verification.

Official resources

This article is AI-assisted and based on the supplied source corpus.