CVE-2026-12851

{"id": "CVE-2026-12851", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12851", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T12:50:41.800146Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "affectedData": [{"vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "versions": [{"status": "affected", "version": "V2.09"}, {"status": "unaffected", "version": "V2.12"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T05:17:27.157", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2379", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}, {"url": "https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.\n\n\n`libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)\n\n\n#### CNetSetObj::m_F_n_Set_DNS_Addr command injection\n\nThe following function can take up to two addresses, performs no sanitization and then calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. \n\n\n\n int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj *this, char *dns1, char *dns2)\n\n {\n\n int result; // r0\n\n char v5[80]; // [sp+0h] [bp-50h] BYREF\n\n\n\n if ( !dns1 )\n\n result = 0;\n\n if ( dns1 )\n\n {\n\n sprintf(v5, \"/bin/echo nameserver %s > /etc/resolv.conf\", dns1); // attacker controlled dns1 field\n\n system(v5);\n\n if ( dns2 )\n\n {\n\n sprintf(v5, \"/bin/echo nameserver %s >> /etc/resolv.conf\", dns2);\n\n system(v5);\n\n }\n\n return 1;\n\n }\n\n return result;"}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n de comandos del sistema operativo existen en la funcionalidad libNetSetObj.so de GeoVision GV-I/O Box 4E 2.09. Un paquete de red especialmente dise\u00f1ado puede llevar a la ejecuci\u00f3n de comandos. Un atacante puede enviar una solicitud de red para activar esta vulnerabilidad.\n\n\u2019libNetSetObj.so\u2019 es una biblioteca interna utilizada por varios binarios en el dispositivo para configurar la pila de red (iniciar y detener varios servicios, configurar IP, m\u00e1scara de red, puerta de enlace, DNS, etc.).\n\n#### Inyecci\u00f3n de comandos en CNetSetObj::m_F_n_Set_DNS_Addr\n\nLa siguiente funci\u00f3n puede tomar hasta dos direcciones, no realiza ninguna sanitizaci\u00f3n y luego llama a system. Esta es una vulnerabilidad cl\u00e1sica de inyecci\u00f3n de comandos. La funci\u00f3n es accesible tanto desde el servicio \u2019DVRSearch\u2019 expuesto en la red como desde el endpoint \u2019Network.cgi\u2019.\n\n int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj this, char dns1, char dns2)\n {\n int result; // r0\n char v5[80]; // [sp+0h] [bp-50h] BYREF\n\n if ( !dns1 )\n result = 0;\n if ( dns1 )\n {\n sprintf(v5, \u201c/bin/echo nameserver %s > /etc/resolv.conf\u201d, dns1); // campo dns1 controlado por el atacante\n system(v5);\n if ( dns2 )\n {\n sprintf(v5, \u201c/bin/echo nameserver %s >> /etc/resolv.conf\u201d, dns2);\n system(v5);\n }\n return 1;\n }\n return result;\n }"}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9"}