CVE-2026-7841 — GV-ASWeb Remote Code Execution (RCE) vulnerability

CVE-2026-7841

GV-ASWeb Remote Code Execution (RCE) vulnerability PUBLISHED

Description (CNA)

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.

Affected (CNA)

Vendor / product	Versions
GeoVision Inc. / ASManager	affected V6.2.0; unaffected V6.3.0

CWE

CWE-94

References

https://www.geovision.com.tw/cyber_security.php

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.