CVE-2026-12851

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09

Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially crafted network packet. The CNetSetObj::m F n Set DNS Addr() function fails to sanitize input before passing it to the system call. This issue is reachable via the Network.cgi endpoint and the DVRSearch service. The vulnerable parameters are dns1 and dns2.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.