CVE-2026-12851

{
  "id": "CVE-2026-12851",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-06-24T05:17:27.157",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.\n\n\n`libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)\n\n\n#### CNetSetObj::m_F_n_Set_DNS_Addr command injection\n\nThe following function can take up to two addresses, performs no sanitization and then calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. \n\n\n\n    int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj *this, char *dns1, char *dns2)\n\n    {\n\n      int result; // r0\n\n      char v5[80]; // [sp+0h] [bp-50h] BYREF\n\n\n\n      if ( !dns1 )\n\n        result = 0;\n\n      if ( dns1 )\n\n      {\n\n        sprintf(v5, \"/bin/echo nameserver %s > /etc/resolv.conf\", dns1);  // attacker controlled dns1 field\n\n        system(v5);\n\n        if ( dns2 )\n\n        {\n\n          sprintf(v5, \"/bin/echo nameserver %s >> /etc/resolv.conf\", dns2);\n\n          system(v5);\n\n        }\n\n        return 1;\n\n      }\n\n      return result;"
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección de comandos del sistema operativo existen en la funcionalidad libNetSetObj.so de GeoVision GV-I/O Box 4E 2.09. Un paquete de red especialmente diseñado puede llevar a la ejecución de comandos. Un atacante puede enviar una solicitud de red para activar esta vulnerabilidad.\n\n’libNetSetObj.so’ es una biblioteca interna utilizada por varios binarios en el dispositivo para configurar la pila de red (iniciar y detener varios servicios, configurar IP, máscara de red, puerta de enlace, DNS, etc.).\n\n#### Inyección de comandos en CNetSetObj::m_F_n_Set_DNS_Addr\n\nLa siguiente función puede tomar hasta dos direcciones, no realiza ninguna sanitización y luego llama a system. Esta es una vulnerabilidad clásica de inyección de comandos. La función es accesible tanto desde el servicio ’DVRSearch’ expuesto en la red como desde el endpoint ’Network.cgi’.\n\n    int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj this, char dns1, char dns2)\n    {\n      int result; // r0\n      char v5[80]; // [sp+0h] [bp-50h] BYREF\n\n      if ( !dns1 )\n        result = 0;\n      if ( dns1 )\n      {\n        sprintf(v5, “/bin/echo nameserver %s > /etc/resolv.conf”, dns1);  // campo dns1 controlado por el atacante\n        system(v5);\n        if ( dns2 )\n        {\n          sprintf(v5, “/bin/echo nameserver %s >> /etc/resolv.conf”, dns2);\n          system(v5);\n        }\n        return 1;\n      }\n      return result;\n    }"
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GV-I/O Box 4E",
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "versions": [
            {
              "version": "V2.09",
              "status": "affected"
            },
            {
              "version": "V2.12",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T12:50:41.800146Z",
          "id": "CVE-2026-12851",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    },
    {
      "url": "https://www.geovision.com.tw/cyber_security.php",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    }
  ]
}