CVE-2026-7841 - Vulnerability Details - OpenCVE

ReportizFlow

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Geovision	Gv-asmanager
Geovision Inc.	Asmanager

No data.

No data.

References

Link	Providers
https://www.geovision.com.tw/cyber_security.php

History

Wed, 06 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 06 May 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Geovision Geovision gv-asmanager
Vendors & Products		Geovision Geovision gv-asmanager

Wed, 06 May 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.
Title		GV-ASWeb Remote Code Execution (RCE) vulnerability
First Time appeared		Geovision Inc. Geovision Inc. asmanager
Weaknesses		CWE-94
CPEs		cpe:2.3:a:geovision_inc.:asmanager:v6.2.0::windows::::: cpe:2.3:a:geovision_inc.:asmanager:v6.3.0::windows:::::
Vendors & Products		Geovision Inc. Geovision Inc. asmanager
References		https://www.geovision.com.tw/cyber_security.php
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GV

Published: 2026-05-06T06:47:53.765Z

Updated: 2026-05-07T01:13:11.587Z

Reserved: 2026-05-05T07:36:15.083Z

Link: CVE-2026-7841

Vulnrichment

Updated: 2026-05-06T12:54:45.679Z

NVD

Status : Received

Published: 2026-05-06T08:16:04.490

Modified: 2026-05-06T08:16:04.490

Link: CVE-2026-7841

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7841", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-05-05T07:36:15.083Z", "datePublished": "2026-05-06T06:47:53.765Z", "dateUpdated": "2026-05-07T01:13:11.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-05-07T01:13:11.587Z"}, "title": "GV-ASWeb Remote Code Execution (RCE) vulnerability", "datePublic": "2026-05-05T07:53:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "ASManager", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "V6.2.0"}, {"status": "unaffected", "version": "V6.3.0"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:asmanager:v6.2.0:*:windows:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:asmanager:v6.3.0:*:windows:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability\nexists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated\nuser with System Setting permissions can execute arbitrary commands on the\nserver by sending a crafted HTTP POST request to the ASWebCommon.srf backend\nendpoint to bypass the frontend restrictions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A remote code execution vulnerability\nexists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated\nuser with System Setting permissions can execute arbitrary commands on the\nserver by sending a crafted HTTP POST request to the ASWebCommon.srf backend\nendpoint to bypass the frontend restrictions.</p>"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Reported Vulnerability is going to be fixed with the official release of GeoVision's ASMAnager V6.3.0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Reported Vulnerability is going to be fixed with the official release of GeoVision's ASMAnager V6.3.0"}]}], "timeline": [{"time": "2026-04-28T17:05:00.000Z", "lang": "en", "value": "Initial report to vendor"}], "credits": [{"lang": "en", "value": "Patrick Tung", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T12:54:41.338584Z", "id": "CVE-2026-7841", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T12:54:50.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7841", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T12:54:41.338584Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T12:54:45.679Z"}}], "cna": {"title": "GV-ASWeb Remote Code Execution (RCE) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Patrick Tung"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "ASManager", "versions": [{"status": "affected", "version": "V6.2.0"}, {"status": "unaffected", "version": "V6.3.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-28T17:05:00.000Z", "value": "Initial report to vendor"}], "solutions": [{"lang": "en", "value": "Reported Vulnerability is going to be fixed with the official release of GeoVision's ASMAnager V6.3.0", "supportingMedia": [{"type": "text/html", "value": "Reported Vulnerability is going to be fixed with the official release of GeoVision's ASMAnager V6.3.0", "base64": false}]}], "datePublic": "2026-05-05T07:53:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability\nexists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated\nuser with System Setting permissions can execute arbitrary commands on the\nserver by sending a crafted HTTP POST request to the ASWebCommon.srf backend\nendpoint to bypass the frontend restrictions.", "supportingMedia": [{"type": "text/html", "value": "<p>A remote code execution vulnerability\nexists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated\nuser with System Setting permissions can execute arbitrary commands on the\nserver by sending a crafted HTTP POST request to the ASWebCommon.srf backend\nendpoint to bypass the frontend restrictions.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:asmanager:v6.2.0:*:windows:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:geovision_inc.:asmanager:v6.3.0:*:windows:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-05-07T01:13:11.587Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7841", "state": "PUBLISHED", "dateUpdated": "2026-05-07T01:13:11.587Z", "dateReserved": "2026-05-05T07:36:15.083Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-05-06T06:47:53.765Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}