OS Command Injection Vulnerability in GeoVision GV-I/O Box 4E

CVE-2026-12849

What is CVE-2026-12849?

Multiple OS command injection vulnerabilities have been identified in the internal library libNetSetObj.so used by GeoVision's GV-I/O Box 4E. By sending specially crafted network packets, an attacker can exploit these vulnerabilities to execute arbitrary commands on the device. The affected functionalities include the network configuration operations that do not properly sanitize input, particularly in the m_F_n_Set_Net_Mask function. This function can be accessed through network-exposed services, resulting in potential unauthorized control over critical network settings.

References