Description
A remote code execution vulnerability
exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated
user with System Setting permissions can execute arbitrary commands on the
server by sending a crafted HTTP POST request to the ASWebCommon.srf backend
endpoint to bypass the frontend restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GeoVision | ASManager | V6.2.0 | V6.3.0 |
References
- https://www.geovision.com.tw/cyber_security.php vendor-advisory