CVE-2026-7841 - Vulnerability Analysis

Overview

GeoVision GV-ASWeb 6.2.0 contains a remote code execution caused by crafted HTTP POST request to ASWebCommon.srf backend endpoint, letting authenticated users with System Setting permissions execute arbitrary commands, exploit requires System Setting permissions.

Severity & Score

Impact

Authenticated users with System Setting permissions can execute arbitrary commands on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version of GeoVision GV-ASWeb.

References

• https://www.geovision.com.tw/cyber_security.php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner