CVE-2026-108983 PUBLISHED

GV-ASManager Web Server Command Injection Vulnerability

Assigner: GV
Reserved: 12.10.2026 Published: 19.10.2026 Updated: 19.10.2026

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor GeoVision Inc.
Product GV-ASManager
Versions Default: unaffected
  • Version 6.3.0 is affected
  • Version 6.4.0 is unaffected

Credits

  • Aleksandr Koshelev - https://www.linkedin.com/in/aleksandr-koshelev-30b34b171/ finder
  • crowdfense - https://www.crowdfense.com/ finder

References

Problem Types

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

  • CAPEC-88 OS Command Injection