GeoVision GV-ASManager: OS command injection in web server
Summary
The CNA record describes an OS command injection (CWE-78) in the web server component GeoWebServer.exe of GeoVision GV-ASManager, scored CVSS 9.8. Per the vector, a remote attacker who can reach the web ports needs no authentication or user interaction and could potentially execute operating system commands with high impact. A secondary source classifies the flaw as information disclosure (CVSS 5.3, CWE-200), so the classification is disputed until the vendor advisory is checked.
Affected
- GV-ASManager up to and including 6.3.0 (CNA record and VulDB)
- Platform: Windows (CNA record)
- The Canadian Cyber Centre wording "prior to V6.3.0" does not clearly settle whether 6.3.0 itself is affected.
Fixed in
- Upgrade to GV-ASManager 6.4.0 (CNA record and VulDB).
- The vendor advisory GV-ASM-2026-10-01 could not be retrieved and is not yet verified.
Workaround
- No vendor-specific workaround found.
- Block the GV-ASManager web ports from the internet; allow access only from management VLANs or VPN until patched.
- Run GeoWebServer.exe with restricted privileges and minimal user rights (generic hardening, not vendor guidance).
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- CISA SSVC data in the CVE record: exploitation none, automatable yes.
- No public proof of concept found in research; this does not prove that none exists.
Our recommendation
- Inventory all GV-ASManager installations and their versions.
- Check whether the web ports are reachable from the internet; if so, restrict them immediately.
- Upgrade to 6.4.0, or to the version named in vendor advisory GV-ASM-2026-10-01 once it is verified.
- Review logs for unexpected child processes spawned by GeoWebServer.exe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GeoVision Cyber Security www.geovision.com.tw
- VulDB CVE-2026-108983 vuldb.com
- VulDB vulnerability 422237 vuldb.com
- Vulners CVE-2026-108983 vulners.com
- OpenCVE CVE-2026-108983 app.opencve.io
- CVE threat intelligence CVE-2026-108983 cve.threatint.com
- CVE brief 2026-10-19 cvebrief.com
- Strix CVE-2026-108983 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:30.
Original description (NVD)
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.