CVE-2025-26264

GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

23.03% chance of exploitation in the next 30 days, 98th percentile

Published

2025-02-27

Updated

2025-03-19

Proof-of-concept exploits (1)

• hxlxmj/CVE-2025-26264

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52424

References

• CVE Record
• NVD entry

Related

• CVE-2022-0847
• CVE-2022-29464
• CVE-2025-26263
• CVE-2025-2627
• CVE-2025-26260
• CVE-2025-2628