CVE-2026-12850

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09

Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially crafted network packet. Specifically, the m F n Set Gate way() function fails to sanitize the gateway address string before passing it to a system call. This issue is reachable via the Network.cgi endpoint and the DVRSearch service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.