CVE-2026-12851: GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

Synopsis

An OS command injection vulnerability exists in the libNetSetObj.so library used by GeoVision GV-I/O Box 4E firmware version 2.09. The flaw is reachable over the network by an authenticated attacker with administrator privileges, via either the DVRSearch service or the Network.cgi endpoint, and stems from unsanitized user input passed directly to a system() call. Successful exploitation gives the attacker full command execution on the device, with the ability to read, modify, or destroy all data and crash or hijack device operation. A patched-image rebuild at version V2.12 is available on HarborGuard for environments running the affected firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device over the network, as the vulnerable code paths are exposed through the DVRSearch service and the Network.cgi endpoint.

• AuthenticationRequired

  An admin-level account is required to reach the affected network configuration endpoints that invoke the vulnerable DNS-setting function.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted network request directly to the vulnerable service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or memory layout knowledge.

Blast Radius

• The attacker executes arbitrary OS commands on the device with the privileges of the process hosting DVRSearch or Network.cgi, giving full control over the operating environment.
• All data stored on or accessible through the device is readable, including credentials, configuration files, and any connected sensor or I/O state.
• The attacker can modify device configuration, overwrite firmware state, or pivot to other network-adjacent systems reachable from the device.
• The affected service and the device itself can be crashed or rendered permanently unavailable by malicious commands passed through the injection point.