CVE-2026-12486: GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

Synopsis

An OS command injection vulnerability exists in the libNetSetObj.so shared library on the GeoVision GV-I/O Box 4E (firmware V2.09). The flaw is reachable over the network by an authenticated attacker with admin-level credentials, who can send a crafted network request to the DVRSearch service or the Network.cgi endpoint to inject arbitrary OS commands. Successful exploitation gives the attacker full command execution on the device, enabling complete confidentiality, integrity, and availability compromise. A patched-image rebuild at V2.12 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device over the network; both the DVRSearch service and the Network.cgi endpoint are the exposed attack surface.

• AuthenticationRequired

  An admin-privileged account is needed to reach the vulnerable network configuration endpoints that invoke libNetSetObj.so.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted network request directly to the target service.

• Attack complexityDetail

  Attack complexity is low; the injection is a straightforward unsanitized string passed to system(), requiring no race conditions or special environmental conditions.

Blast Radius

• The attacker executes arbitrary OS commands as the process user of the DVRSearch or Network.cgi service, gaining a foothold on the device.
• All data stored on or accessible to the device, including credentials and configuration secrets, is readable by the attacker.
• The attacker can modify network stack configuration, overwrite files, or install persistent backdoors on the device.
• The attacker can crash or disable device services, taking the I/O box offline and disrupting any physical access control or monitoring systems it supports.