CVE-2025-26264: GeoVision GV-ASWeb RCE Vulnerability

CVE-2025-26264 Overview

CVE-2025-26264 is a Remote Code Execution (RCE) vulnerability in GeoVision GV-ASWeb version 6.1.2.0 and earlier. The flaw resides in the Notification Settings feature of the access control web application. An authenticated attacker holding System Settings privileges can inject arbitrary operating system commands through this feature. Successful exploitation results in command execution under the privileges of the ASWeb service, leading to full server compromise. GeoVision addressed the issue in version 6.2.0. The vulnerability maps to CWE-94: Improper Control of Generation of Code. A public proof-of-concept exists in the DRAGOWN GitHub repository.

Critical Impact
Authenticated administrators can execute arbitrary commands on GeoVision GV-ASWeb servers, enabling complete takeover of access control infrastructure.

Affected Products

GeoVision GV-ASWeb 6.1.2.0
GeoVision GV-ASWeb versions prior to 6.1.2.0
GeoVision GV-ASManager (bundled access control suite)

Discovery Timeline

2025-02-27 - CVE-2025-26264 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-26264

Vulnerability Analysis

GV-ASWeb is the browser-based management interface for GeoVision's GV-ASManager access control platform. The Notification Settings feature allows administrators to configure alerts triggered by door, card, and alarm events. The handler passes administrator-supplied input into a command execution context without sufficient validation or sanitization. An attacker authenticated with System Settings privileges can inject shell metacharacters that the server interprets as additional commands. Code executes in the security context of the ASWeb service account, typically a privileged Windows user. Because GV-ASManager controls physical access systems, a compromised server can manipulate doors, audit logs, and credential databases.

Root Cause

The root cause is improper control of code generation [CWE-94] within the Notification Settings input handler. The application concatenates user-controlled values into a command string passed to the operating system. No allowlist filtering or parameterized execution is applied before invocation.

Attack Vector

Exploitation requires network access to the ASWeb web interface and valid credentials with System Settings privileges. The attacker submits a crafted payload through the Notification Settings configuration form. The server processes the malicious input and runs the injected commands. The vulnerability does not require user interaction beyond the attacker's authenticated session. Refer to the public proof-of-concept for the specific request structure and parameter targeted.

Detection Methods for CVE-2025-26264

Indicators of Compromise

Unexpected child processes spawned by the GV-ASWeb or IIS worker process, particularly cmd.exe, powershell.exe, or wscript.exe.
Modifications to Notification Settings configuration outside of approved change windows.
Outbound network connections initiated by the ASWeb host to untrusted addresses shortly after administrative logins.
New scheduled tasks, services, or local accounts created on the ASManager server.

Detection Strategies

Monitor process ancestry on ASWeb servers and alert on web service processes launching command interpreters or scripting hosts.
Inspect IIS or ASWeb access logs for POST requests to Notification Settings endpoints containing shell metacharacters such as &, |, ;, or backticks.
Correlate administrative authentication events with subsequent process or file system changes on the host.

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on Windows hosts running GV-ASManager.
Forward ASWeb application logs and Windows Security event logs to a centralized SIEM for retention and correlation.
Baseline normal administrator activity on the ASWeb console so deviations in configuration changes generate alerts.

How to Mitigate CVE-2025-26264

Immediate Actions Required

Upgrade GV-ASWeb to version 6.2.0 or later using the official GeoVision download portal.
Restrict the ASWeb management interface to trusted administrative networks through firewall rules or VPN access.
Rotate credentials for all accounts with System Settings privileges and audit recent administrative actions.
Review Notification Settings entries for unauthorized modifications and remove suspicious values.

Patch Information

GeoVision fixed CVE-2025-26264 in GV-ASWeb version 6.2.0. The patched build is distributed through the GeoVision GV-ASManager download page. Apply the update on all servers running affected versions and confirm the post-upgrade version string in the ASWeb interface.

Workarounds

Limit System Settings privileges to a minimal set of named administrators until patching is complete.
Place the ASWeb interface behind a reverse proxy that enforces multi-factor authentication and IP allowlisting.
Disable or remove Notification Settings entries that are not actively in use to reduce exposure of the vulnerable handler.

bash

# Configuration example
# Restrict access to GV-ASWeb to a management subnet (Windows Firewall)
netsh advfirewall firewall add rule name="GV-ASWeb Restrict" ^
  dir=in action=allow protocol=TCP localport=80,443 ^
  remoteip=10.10.50.0/24
netsh advfirewall firewall add rule name="GV-ASWeb Block Others" ^
  dir=in action=block protocol=TCP localport=80,443