CVE-2026-7841: GeoVision GV-ASWeb RCE Vulnerability

CVE-2026-7841 Overview

CVE-2026-7841 is a remote code execution vulnerability in the Notification Settings component of GeoVision GV-ASWeb 6.2.0. An authenticated user holding System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint. The request bypasses frontend input restrictions and reaches command execution logic. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Authenticated attackers with System Setting privileges can run arbitrary operating system commands, leading to full compromise of the GV-ASWeb access control server.

Affected Products

GeoVision GV-ASWeb 6.2.0
GeoVision access control web management interface using ASWebCommon.srf
Deployments exposing the GV-ASWeb administrative interface to internal or external networks

Discovery Timeline

2026-05-06 - CVE-2026-7841 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7841

Vulnerability Analysis

The vulnerability resides in the Notification Settings feature of GeoVision GV-ASWeb 6.2.0. The web frontend applies validation rules that limit which characters and values administrators can submit through the Notification Settings page. These restrictions are enforced only in the browser-side interface.

The backend endpoint ASWebCommon.srf processes notification configuration requests without re-validating the same constraints server-side. An authenticated user can issue a crafted HTTP POST request directly to ASWebCommon.srf, supplying parameters that the frontend would normally reject. The backend passes these values into a code or command execution path, resulting in arbitrary command execution under the GV-ASWeb service account.

The issue maps to [CWE-94] because attacker-supplied data is interpreted as code by the backend. The EPSS score is 0.357% as of 2026-05-07.

Root Cause

The root cause is server-side trust of client-side validation. The Notification Settings handler in ASWebCommon.srf accepts input that the user interface promises to sanitize, but no equivalent server-side filter exists. Inputs are then incorporated into a command or code construct without escaping.

Attack Vector

Exploitation requires network access to the GV-ASWeb interface and valid credentials with System Setting permissions. The attacker authenticates, then submits a POST request to ASWebCommon.srf containing the malicious notification payload. No user interaction is required beyond the attacker's own session. Because no verified proof-of-concept code is publicly available, the exploitation mechanism is described in prose only. See the GeoVision Cyber Security Overview for vendor guidance.

Detection Methods for CVE-2026-7841

Indicators of Compromise

HTTP POST requests to ASWebCommon.srf originating from administrator sessions that contain shell metacharacters such as ;, |, &, or backticks in notification fields.
Child processes spawned by the GV-ASWeb application process such as cmd.exe, powershell.exe, or other command interpreters.
New scheduled tasks, services, or local accounts created shortly after Notification Settings changes.

Detection Strategies

Inspect web server and application logs for direct POST requests to ASWebCommon.srf that bypass the standard Notification Settings UI workflow.
Correlate authentication events for users with System Setting permissions against subsequent process creation on the GV-ASWeb host.
Alert on outbound network connections from the GV-ASWeb server to unexpected destinations following configuration changes.

Monitoring Recommendations

Enable verbose logging on the GV-ASWeb application and forward logs to a central SIEM for retention and correlation.
Track administrative account usage and review System Setting permission assignments on a recurring basis.
Monitor file integrity for the GV-ASWeb installation directory and notification configuration files.

How to Mitigate CVE-2026-7841

Immediate Actions Required

Restrict network access to the GV-ASWeb management interface using firewall rules or VPN-only access.
Audit accounts that hold System Setting permissions and remove the privilege from any account that does not require it.
Rotate credentials for all administrative GV-ASWeb accounts and enforce strong password policies.
Review recent notification configuration changes and process execution history on GV-ASWeb servers for signs of abuse.

Patch Information

GeoVision publishes security updates through its security portal. Refer to the GeoVision Cyber Security Overview for the latest fixed build of GV-ASWeb and apply it to all affected 6.2.0 deployments. Verify the upgraded version after installation.

Workarounds

Limit access to ASWebCommon.srf at the reverse proxy or web application firewall level until a patched version is deployed.
Disable or constrain the Notification Settings feature where it is not actively used.
Place GV-ASWeb servers on an isolated management network segment that blocks direct internet exposure.

bash

# Example: restrict ASWebCommon.srf to internal management subnet via reverse proxy
location /ASWebCommon.srf {
    allow 10.10.20.0/24;
    deny all;
    proxy_pass http://gv-asweb-backend;
}