CVE-2026-12849

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_Net_Mask command injection The following function takes a string as a net mask address, performs no sanitization on it and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. int __fastcall CNetSetObj::m_F_n_Set_Net_Mask(const char **this, char *netmask_addr) { bool v2; // zf char v4[72]; // [sp+0h] [bp-48h] BYREF v2 = *this == 0; if ( *this ) v2 = netmask_addr == 0; if ( v2 ) return 0; sprintf(v4, "/sbin/ifconfig %s netmask %s", *this, netmask_addr); // attacker controlled netmask_addr system(v4); return 1; }

• CWE-78

• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379
• https://www.geovision.com.tw/cyber_security.php

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1284An Out-Of-Bounds Write vulnerability affecting the EPRT file…7.8
• CVE-2026-12844List::SomeUtils::XS versions before 0.59 for Perl have a hea…7.5
• CVE-2026-12845Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-12846GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12847GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12848GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-1285An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…7.5
• CVE-2026-12850Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12851Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12852In Bouncy Castle for Java before 1.85, MLS wire decoder allo…8.7
• CVE-2026-12856A flaw was found in the vscode-java extension, which provide…8.8
• CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exi…6.5