CVE-2026-7841: GeoVision GV-ASWeb RCE Vulnerability

CVE-2026-7841 Overview

CVE-2026-7841 is a remote code execution vulnerability in the Notification Settings component of GeoVision GV-ASWeb 6.2.0. An authenticated user holding System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint. The request bypasses frontend input restrictions and reaches command execution logic. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact

Authenticated attackers with System Setting privileges can run arbitrary operating system commands, leading to full compromise of the GV-ASWeb access control server.

Affected Products

• GeoVision GV-ASWeb 6.2.0
• GeoVision access control web management interface using ASWebCommon.srf
• Deployments exposing the GV-ASWeb administrative interface to internal or external networks

Discovery Timeline

• 2026-05-06 - CVE-2026-7841 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7841

Vulnerability Analysis

The vulnerability resides in the Notification Settings feature of GeoVision GV-ASWeb 6.2.0. The web frontend applies validation rules that limit which characters and values administrators can submit through the Notification Settings page. These restrictions are enforced only in the browser-side interface.

The backend endpoint ASWebCommon.srf processes notification configuration requests without re-validating the same constraints server-side. An authenticated user can issue a crafted HTTP POST request directly to ASWebCommon.srf, supplying parameters that the frontend would normally reject. The backend passes these values into a code or command execution path, resulting in arbitrary command execution under the GV-ASWeb service account.

The issue maps to [CWE-94] because attacker-supplied data is interpreted as code by the backend. The EPSS score is 0.357% as of 2026-05-07.

Root Cause

The root cause is server-side trust of client-side validation. The Notification Settings handler in ASWebCommon.srf accepts input that the user interface promises to sanitize, but no equivalent server-side filter exists. Inputs are then incorporated into a command or code construct without escaping.

Attack Vector

Exploitation requires network access to the GV-ASWeb interface and valid credentials with System Setting permissions. The attacker authenticates, then submits a POST request to ASWebCommon.srf containing the malicious notification payload. No user interaction is required beyond the attacker's own session. Because no verified proof-of-concept code is publicly available, the exploitation mechanism is described in prose only. See the GeoVision Cyber Security Overview for vendor guidance.

Detection Methods for CVE-2026-7841

Indicators of Compromise

• HTTP POST requests to ASWebCommon.srf originating from administrator sessions that contain shell metacharacters such as ;, |, &, or backticks in notification fields.
• Child processes spawned by the GV-ASWeb application process such as cmd.exe, powershell.exe, or other command interpreters.
• New scheduled tasks, services, or local accounts created shortly after Notification Settings changes.

Detection Strategies

• Inspect web server and application logs for direct POST requests to ASWebCommon.srf that bypass the standard Notification Settings UI workflow.
• Correlate authentication events for users with System Setting permissions against subsequent process creation on the GV-ASWeb host.
• Alert on outbound network connections from the GV-ASWeb server to unexpected destinations following configuration changes.

Monitoring Recommendations

• Enable verbose logging on the GV-ASWeb application and forward logs to a central SIEM for retention and correlation.
• Track administrative account usage and review System Setting permission assignments on a recurring basis.
• Monitor file integrity for the GV-ASWeb installation directory and notification configuration files.

How to Mitigate CVE-2026-7841

Immediate Actions Required

• Restrict network access to the GV-ASWeb management interface using firewall rules or VPN-only access.
• Audit accounts that hold System Setting permissions and remove the privilege from any account that does not require it.
• Rotate credentials for all administrative GV-ASWeb accounts and enforce strong password policies.
• Review recent notification configuration changes and process execution history on GV-ASWeb servers for signs of abuse.

Patch Information

GeoVision publishes security updates through its security portal. Refer to the GeoVision Cyber Security Overview for the latest fixed build of GV-ASWeb and apply it to all affected 6.2.0 deployments. Verify the upgraded version after installation.

Workarounds

• Limit access to ASWebCommon.srf at the reverse proxy or web application firewall level until a patched version is deployed.
• Disable or constrain the Notification Settings feature where it is not actively used.
• Place GV-ASWeb servers on an isolated management network segment that blocks direct internet exposure.

# Example: restrict ASWebCommon.srf to internal management subnet via reverse proxy
location /ASWebCommon.srf {
    allow 10.10.20.0/24;
    deny all;
    proxy_pass http://gv-asweb-backend;
}