CVE-2026-12851— GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
Quick assessment
Affected
GeoVision Inc. GV-I/O Box 4E
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GeoVision GV-I/O Box 4E是日本GeoVision公司的一款用于安全监控系统的网络输入输出扩展控制模块。 GeoVision GV-I/O Box 4E 2.09版本存在命令注入漏洞，该漏洞源于libNetSetObj.so功能中存在多操作系统命令注入漏洞，可能导致特制网络数据包引发命令执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| GeoVision Inc. | GV-I/O Box 4E | V2.09 |
affected |
V2.12 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.
`libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)
#### CNetSetObj::m_F_n_Set_DNS_Addr command injection
The following function can take up to two addresses, performs no sanitization and then calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint.
int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj *this, char *dns1, char *dns2)
{
int result; // r0
char v5[80]; // [sp+0h] [bp-50h] BYREF
if ( !dns1 )
result = 0;
if ( dns1 )
{
sprintf(v5, "/bin/echo nameserver %s > /etc/resolv.conf", dns1); // attacker controlled dns1 field
system(v5);
if ( dns2 )
{
sprintf(v5, "/bin/echo nameserver %s >> /etc/resolv.conf", dns2);
system(v5);
}
return 1;
}
return result;
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
GeoVision GV-I/O Box 4E 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GeoVision GV-I/O Box 4E是日本GeoVision公司的一款用于安全监控系统的网络输入输出扩展控制模块。 GeoVision GV-I/O Box 4E 2.09版本存在命令注入漏洞，该漏洞源于libNetSetObj.so功能中存在多操作系统命令注入漏洞，可能导致特制网络数据包引发命令执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GeoVision Inc. | GV-I/O Box 4E | V2.09 | - |
|
II. Public POCs for CVE-2026-12851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12851
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12851 (1)
Vendor Pages for CVE-2026-12851 (1)
Same Patch Batch · GeoVision Inc. · 2026-06-24 · 9 CVEs total
| CVE-2026-12847 | 10.0 CRITICAL | GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command |
| CVE-2026-12848 | 10.0 CRITICAL | GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command |
| CVE-2026-12846 | 10.0 CRITICAL | GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command |
| CVE-2026-12485 | 10.0 CRITICAL | GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command |
| CVE-2026-12486 | 9.1 CRITICAL | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability |
| CVE-2026-12849 | 9.1 CRITICAL | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability |
| CVE-2026-12850 | 9.1 CRITICAL | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability |
| CVE-2026-12488 | 6.2 MEDIUM | GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability |
IV. Related Vulnerabilities
Same product: GV-I/O Box 4E
-
CVE-2026-12850
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection -
CVE-2026-12849
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection -
CVE-2026-12486
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection -
CVE-2026-12848
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabiliti -
CVE-2026-12847
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabiliti
Same vendor: GeoVision Inc.
-
CVE-2026-92838
GeoVision GV-Remote E-Map dll hijacking vulnerability -
CVE-2026-88290
GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Mem -
CVE-2026-88289
GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffe -
CVE-2026-88288
GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadL -
CVE-2026-88287
GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame
Same weakness: CWE-78
-
CVE-2026-79898
Fortra BoKS Manager crlserver command injection vulnerabilit -
CVE-2026-76146
Genians, Inc Genian SSL PNS OS Command Injection -
CVE-2026-102112
Kiteworks Core Local Privilege Escalation -
CVE-2026-102114
Kiteworks Core OS Command Injection -
CVE-2026-102120
Kiteworks Core OS Command Injection
V. Comments for CVE-2026-12851
No comments yet