CVE-2026-4606

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4606", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-03-23T00:46:43.918Z", "datePublished": "2026-03-23T01:05:31.952Z", "dateUpdated": "2026-03-24T03:56:02.798Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-03-23T01:15:18.367Z"}, "title": "GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege", "datePublic": "2026-03-23T01:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-250", "description": "CWE-250 Execution with unnecessary privileges", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-113", "descriptions": [{"lang": "en", "value": "CAPEC-113 Interface Manipulation"}]}], "affected": [{"vendor": "GeoVision", "product": "GV-Edge Recording Manager", "platforms": ["Windows"], "collectionURL": "https://www.geovision.com.tw/download/product/GV%E2%80%90Edge%20Recording%20Manager%20(Windows%20Version)", "packageName": "GV-Edge Recording Manager", "versions": [{"status": "affected", "version": "2.3.1"}, {"status": "unaffected", "version": "2.3.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.\u00a0\n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account.\u00a0\n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.\u00a0\n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.\u00a0\n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk.\u00a0\n\nThis vulnerability allows local privilege escalation and may result in full system compromise.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.&nbsp;</p><p>During installation, ERM creates a Windows service that runs under the LocalSystem account.&nbsp;</p><p>When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.&nbsp;</p><p>Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.&nbsp;</p><p>Any ERM function invoking Windows file open/save dialogs exposes the same risk.&nbsp;</p><p>This vulnerability allows local privilege escalation and may result in full system compromise.</p>"}]}], "references": [{"url": "https://https://www.geovision.com.tw/cyber_security.php"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "NO", "Recovery": "IRRECOVERABLE", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:I/V:C/RE:M/U:Green"}}], "credits": [{"lang": "en", "value": "Reported by security researcher Chao Liu (chaoliu@rbbusa.com)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-4606"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T03:56:02.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4606", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-23T13:35:04.150771Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:35:10.273Z"}}], "cna": {"title": "GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Reported by security researcher Chao Liu (chaoliu@rbbusa.com)"}], "impacts": [{"capecId": "CAPEC-113", "descriptions": [{"lang": "en", "value": "CAPEC-113 Interface Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "IRRECOVERABLE", "baseScore": 10, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:I/V:C/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision", "product": "GV-Edge Recording Manager", "versions": [{"status": "affected", "version": "2.3.1"}, {"status": "unaffected", "version": "2.3.2"}], "platforms": ["Windows"], "packageName": "GV-Edge Recording Manager", "collectionURL": "https://www.geovision.com.tw/download/product/GV%E2%80%90Edge%20Recording%20Manager%20(Windows%20Version)", "defaultStatus": "unaffected"}], "datePublic": "2026-03-23T01:15:00.000Z", "references": [{"url": "https://https://www.geovision.com.tw/cyber_security.php"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.\u00a0\n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account.\u00a0\n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.\u00a0\n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.\u00a0\n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk.\u00a0\n\nThis vulnerability allows local privilege escalation and may result in full system compromise.", "supportingMedia": [{"type": "text/html", "value": "<p>GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.&nbsp;</p><p>During installation, ERM creates a Windows service that runs under the LocalSystem account.&nbsp;</p><p>When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.&nbsp;</p><p>Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.&nbsp;</p><p>Any ERM function invoking Windows file open/save dialogs exposes the same risk.&nbsp;</p><p>This vulnerability allows local privilege escalation and may result in full system compromise.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250 Execution with unnecessary privileges"}]}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-03-23T01:15:18.367Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4606", "state": "PUBLISHED", "dateUpdated": "2026-03-24T03:56:02.798Z", "dateReserved": "2026-03-23T00:46:43.918Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-03-23T01:05:31.952Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.geovision.com.tw/download/product/GV%E2%80%90Edge%20Recording%20Manager%20(Windows%20Version)", "defaultStatus": "unaffected", "packageName": "GV-Edge Recording Manager", "platforms": ["Windows"], "product": "GV-Edge Recording Manager", "vendor": "GeoVision", "versions": [{"status": "affected", "version": "2.3.1"}, {"status": "unaffected", "version": "2.3.2"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.\u00a0\n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account.\u00a0\n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.\u00a0\n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.\u00a0\n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk.\u00a0\n\nThis vulnerability allows local privilege escalation and may result in full system compromise."}, {"lang": "es", "value": "GV Edge Recording Manager (ERM) v2.3.1 ejecuta incorrectamente los componentes de la aplicaci\u00f3n con privilegios de nivel SYSTEM, permitiendo a cualquier usuario local obtener control total del sistema operativo.\n\nDurante la instalaci\u00f3n, ERM crea un servicio de Windows que se ejecuta bajo la cuenta LocalSystem.\n\nCuando se inicia la aplicaci\u00f3n ERM, se generan procesos relacionados bajo privilegios SYSTEM en lugar del contexto de seguridad del usuario que ha iniciado sesi\u00f3n.\n\nFunciones como 'Importar Datos' abren un cuadro de di\u00e1logo de archivos de Windows que opera con permisos SYSTEM, lo que permite la modificaci\u00f3n o eliminaci\u00f3n de archivos y directorios del sistema protegidos.\n\nCualquier funci\u00f3n de ERM que invoque cuadros de di\u00e1logo de abrir/guardar archivos de Windows expone el mismo riesgo.\n\nEsta vulnerabilidad permite la escalada de privilegios local y puede resultar en un compromiso total del sistema."}], "id": "CVE-2026-4606", "lastModified": "2026-06-17T10:56:54.440", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "IRRECOVERABLE", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4606", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-23T02:16:05.213", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "2.3.1"}}, {"platform": ["windows"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.3.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "GV-Edge Recording Manager", "source": "cna", "vendor": "GeoVision"}, "product": "gv-edge_recording_manager", "vendor": "geovision"}], "analysis": {"en": {"generated_at": "2026-03-23T03:21:40.696869+00:00", "value": {"mitigation_remediation": ["Apply the official GeoVision patch or upgrade to a later release that removes the SYSTEM\u2011level service.", "If no patch is available, reconfigure or disable the GV\u2011Edge ERM Windows service and run the application under a standard user account.", "Restrict local user permissions or isolate the ERM deployment from privileged accounts and monitor for unauthorized file changes."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation to SYSTEM"}, "threat_synthesis": {"affected_systems": "The vulnerability is specific to GeoVision's GV-Edge Recording Manager version 2.3.1. No other versions or GeoVision products are mentioned, and the CNA vendor list indicates only GV-Edge Recording Manager as affected. The risk applies to Windows environments where the ERM is installed and a local user has access to launch the application.", "description_and_impact": "GV Edge Recording Manager v2.3.1 contains an improper privilege assignment flaw that causes the application to run components with SYSTEM-level privileges. During installation the software creates a Windows service that operates under the LocalSystem account, and subsequent ERM processes inherit this high privilege context. Because functions such as 'Import Data' use Windows file dialogs that also run under SYSTEM, any local user can manipulate protected system files, directories, or configurations. This flaw results in local privilege escalation, enabling an attacker to gain full control of the operating system.", "risk_and_exploitability": "The CVSS score of 10.0 reflects a maximum severity and indicates that the vulnerability is exploitable in a local context with the attacker already having a user account. While EPSS data is not provided, the lack of a KEV listing does not diminish the need for timely remediation. An attacker can trigger the flaw by simply launching the ERM and selecting any function that opens a file dialog, thereby triggering SYSTEM\u2011level code execution. Once SYSTEM privileges are achieved, the attacker can compromise the entire host."}}}}, "created": "2026-03-23T09:45:43.318649+00:00", "updated": "2026-03-25T14:50:02.725620+00:00", "vendors": ["geovision", "geovision$PRODUCT$gv-edge_recording_manager"]}