CVE-2025-26264

CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

Requirements

To perform successful attack an attacker requires:

• Network access to the GV-ASManager web application with version 6.1.2.0 or less;
• Access to an account with privilege of managing Notification Settings feature.

Impact

The vulnerability can be leveraged to perform the following unauthorized actions:

• An account with privilege of managing Notification Settings feature is able to:
  • Perform Remote Code Execution attack.
• After the successfull attack, an attacker will be able to:
  • Access, modify, or delete sensitive system information;
  • Plant a system backdoor;
  • Perform ransomware attack;
  • Perform lateral movement in the internal network.

CVE-2025-26264 PoC [Testing GeoVision v6.1.2.0]

Exploiting Remote Code Execution vulnerability in GeoVision GV-ASManager's ASWeb platform is possible against versions 6.1.2.0 or less (there is no fix as of 26 February 2025).

GeoVision ASManager's ASWeb function Notification Setting is vulnerable to RCE