CVE-2026-12849

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09

Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially crafted network packet. Specifically, the m F n Set Net Mask() function fails to sanitize the netmask addr variable before passing it to a system call. This issue is reachable via the Network.cgi endpoint and the DVRSearch service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.