CVE-2026-4606: GeoVision GV-Edge Recording Manager, заобикаляне на

Описание

Оригинално описание

GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.  During installation, ERM creates a Windows service that runs under the LocalSystem account.  When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.  Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.  Any ERM function invoking Windows file open/save dialogs exposes the same risk.  This vulnerability allows local privilege escalation and may result in full system compromise.

Засегнати продукти

• GeoVision GV-Edge Recording Manager: 2.3.1; 2.3.2

Вид слабост

• CWE-250 Изпълнение с ненужни привилегии

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-4606
• https://nvd.nist.gov/vuln/detail/CVE-2026-4606
• https://https://www.geovision.com.tw/cyber_security.php