CVE-2026-12851

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_DNS_Addr command injection The following function can take up to two addresses, performs no sanitization and then calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj *this, char *dns1, char *dns2) { int result; // r0 char v5[80]; // [sp+0h] [bp-50h] BYREF if ( !dns1 ) result = 0; if ( dns1 ) { sprintf(v5, "/bin/echo nameserver %s > /etc/resolv.conf", dns1); // attacker controlled dns1 field system(v5); if ( dns2 ) { sprintf(v5, "/bin/echo nameserver %s >> /etc/resolv.conf", dns2); system(v5); } return 1; } return result;

• CWE-78

• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379
• https://www.geovision.com.tw/cyber_security.php

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12846GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12847GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12848GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12849Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-1285An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…7.5
• CVE-2026-12850Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12852In Bouncy Castle for Java before 1.85, MLS wire decoder allo…8.7
• CVE-2026-12856A flaw was found in the vscode-java extension, which provide…8.8
• CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exi…6.5
• CVE-2026-12860In Bouncy Castle for Java before 1.85, RSA PKCS#1 verificati…8.7
• CVE-2026-12862Untrusted user data was passed verbatim to Excel exports for…5.1
• CVE-2026-12863An unvalidated redirect was contained in Venueless' social l…5.1