Authenticated RCE in GeoVision GV-ASWeb Notification Settings

Successful exploitation allows an authenticated attacker with sufficient application privileges to execute arbitrary commands on the server hosting GV-ASWeb. This can result in full system compromise, including takeover of the application server, access to sensitive data processed or stored by the system, modification of configuration and application state, installation of persistence mechanisms, and use of the compromised host for further lateral movement within the environment.

If immediate patching is not possible, restrict access to GV-ASWeb to trusted administrative networks and minimize the number of accounts granted "System Settings" privileges. Monitor and audit use of the Notification Settings feature for anomalous input or command-execution behavior. Apply host-level controls to limit the impact of command execution, including least-privilege service accounts, application allowlisting, network segmentation, and endpoint detection and response on the server. Because exploitation requires authentication and elevated application privileges, reducing privileged account exposure and enforcing strong access controls can materially reduce risk until the upgrade is completed.

Upgrade GeoVision GV-ASWeb to version 6.2.0 or later, as the issue is stated to be fixed in 6.2.0. Validate that all affected deployments running 6.1.2.0 or earlier are identified and updated. After patching, review server logs and application activity for signs of abuse of the Notification Settings feature, and rotate credentials or secrets accessible from the affected host if compromise is suspected.