CVE-2026-4606: GV Edge Recording Manager Privilege Escalation

CVE-2026-4606 Overview

CVE-2026-4606 is a critical local privilege escalation vulnerability affecting GeoVision Edge Recording Manager (ERM) v2.3.1. The application improperly runs components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. This vulnerability stems from improper privilege management during application execution, where related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.

Critical Impact

Any local user can escalate privileges to SYSTEM level through ERM's file dialogs, enabling modification or deletion of protected system files and potentially achieving full system compromise.

Affected Products

• GeoVision Edge Recording Manager (ERM) v2.3.1
• Windows systems running ERM with the vulnerable service configuration

Discovery Timeline

• 2026-03-23 - CVE-2026-4606 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4606

Vulnerability Analysis

This vulnerability is classified as CWE-250: Execution with Unnecessary Privileges. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than inheriting the security context of the logged-in user. This design flaw exposes multiple attack surfaces through standard Windows functionality.

The most concerning aspect is that functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions. Since these dialogs allow navigation of the entire file system with the privileges of the parent process, a local attacker can leverage them to access, modify, or delete protected system files and directories. Any ERM function invoking Windows file open/save dialogs exposes the same risk.

Root Cause

The root cause is improper privilege management in the application architecture. The ERM service is configured to run under the LocalSystem account, which possesses the highest level of privilege on a Windows system. When child processes and UI components are spawned from this service, they inherit these elevated privileges instead of running with the permissions of the interactive user. This violates the principle of least privilege and creates a local privilege escalation vector.

Attack Vector

The attack can be executed by any local user with access to the ERM application. The attacker launches ERM and triggers any functionality that opens a Windows file dialog (such as 'Import Data', 'Export', or similar features). Because the dialog runs with SYSTEM privileges, the attacker can:

1. Navigate to protected system directories (e.g., C:\Windows\System32)
2. Right-click to access context menus and modify file properties
3. Use the dialog's path bar to execute commands
4. Replace or delete critical system files
5. Drop malicious executables into privileged locations

This technique is known as a "file dialog privilege escalation" and is a well-documented method for exploiting applications that improperly elevate privileges for UI components.

Detection Methods for CVE-2026-4606

Indicators of Compromise

• Unexpected file modifications in protected system directories such as C:\Windows\System32 originating from ERM processes
• Process execution chains showing child processes of ERM services accessing sensitive file system locations
• Audit logs indicating file dialog interactions with SYSTEM-owned directories from standard user sessions
• New or modified files in privileged locations with timestamps correlating to ERM application usage

Detection Strategies

• Monitor process creation events for child processes spawned by GVEdgeRecordingManager.exe or related ERM services running as SYSTEM
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Use endpoint detection and response (EDR) solutions to identify anomalous file access patterns from applications running with elevated privileges
• Configure Windows Security Event logging to capture privilege use (Event ID 4672) and process creation (Event ID 4688) for ERM-related processes

Monitoring Recommendations

• Enable detailed audit logging for object access on critical system directories
• Deploy behavioral monitoring rules to detect file dialog exploitation techniques
• Implement application whitelisting to restrict what processes can modify protected system locations
• Configure SentinelOne to monitor for privilege escalation patterns associated with SYSTEM-level file dialogs

How to Mitigate CVE-2026-4606

Immediate Actions Required

• Restrict access to the ERM application to only trusted administrators until a patch is available
• Review and limit local user access to systems running ERM
• Consider disabling or removing ERM from systems where it is not critically needed
• Implement application control policies to prevent exploitation of file dialogs

Patch Information

Check the GeoVision Cyber Security Overview for official security advisories and patch availability. Contact GeoVision support for the latest security updates for Edge Recording Manager.

Workarounds

• Run ERM under a dedicated service account with minimal necessary privileges instead of LocalSystem
• Use Windows Software Restriction Policies or AppLocker to limit which processes can be spawned from ERM
• Implement network segmentation to isolate systems running ERM from critical infrastructure
• Deploy endpoint protection solutions with privilege escalation detection capabilities to identify exploitation attempts

# Example: Modify service to use a less privileged account (requires admin)
# First, create a dedicated service account with minimal privileges
# Then update the service configuration:
sc config "GVEdgeRecordingManager" obj= ".\ERMServiceAccount" password= "<secure_password>"

# Verify the service account change
sc qc "GVEdgeRecordingManager"