GeoVision GV-I/O Box 4E OS Command Injection Vulnerabilities (CVE-2026-12846/49/50)

Vulnerability Overview Talos has identified multiple operating system command injection vulnerabilities in the GeoVision GV-I/O Box 4E device. These vulnerabilities reside in the module, allowing attackers to execute arbitrary commands by sending crafted network requests. Impact Affected Versions: GV-I/O Box 4E (version(s): 2.09) CVSSv3 Score: 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Remediation Initial Vendor Contact: 2026-04-21 Vendor Disclosure: 2026-04-21 Vendor Patch Release: 2026-04-29 Vulnerability Details CVE-2026-12846 - CNetSetObj::m_F_n_Set_IP_Addr Command Injection The following function accepts a string as an IP address, performs no sanitization, and invokes . This is a classic command injection vulnerability. This function is accessible from the network-exposed service and the endpoint. CVE-2026-12849 - CNetSetObj::m_F_n_Set_Net_Mask Command Injection The following function accepts a string as a subnet mask address, performs no sanitization, and invokes . This is a classic command injection vulnerability. This function is accessible from the network-exposed service and the endpoint. CVE-2026-12850 - CNetSetObj::m_F_n_Set_Gate_way Command Injection The following function accepts a string as a gateway address, performs no sanitization, and invokes . This is a classic command injection vulnerability. This function is accessible from the network-exposed service and the endpoint. CVE-2026-12851 - CNetSetObj::m_F_n_Set_DNS_Addr Command Injection The following function accepts up to two addresses, performs no sanitization, and invokes . This is a classic command injection vulnerability. This function is accessible from the network-exposed service and the endpoint. Timeline 2026-04-21 - Initial Vendor Contact 2026-04-21 - Vendor Disclosure 2026-04-29 - Vendor Patch Release Credits Philippe Lauerher of Cisco Talos

Goal Reached Thanks to every supporter — we hit 100%!

GeoVision GV-I/O Box 4E OS Command Injection Vulnerabilities (CVE-2026-12846/49/50)