CVE-2026-4606

GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.  During installation, ERM creates a Windows service that runs under the LocalSystem account.  When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.  Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.  Any ERM function invoking Windows file open/save dialogs exposes the same risk.  This vulnerability allows local privilege escalation and may result in full system compromise.

Score

CVSS 4.0 10.0 Critical

Status

Deferred - 0df08a0e-a200-4957-9bb0-084f562506f9

Published

2026-03-23

Last modified

2026-03-24

Weaknesses

CWE-250

Affected products

• Gv-edge Recording Manager (Geovision)

References

• https://https://www.geovision.com.tw/cyber_security.php