CVE-2026-108983
9.8CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Remote, unauthenticated attackers can execute arbitrary OS commands on systems running the service over the network. They only need network access to the GeoWebServer.exe default ports.
Root cause
Improper neutralization of special elements used in an OS command (OS command injection) in GeoWebServer.exe handling web requests.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Check the GeoVision security portal (https://www.geovision.com.tw/cyber_security.php) for patched software builds; as an immediate mitigation, block inbound access to default GeoWebServer.exe ports or stop the GeoWebServer.exe service.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .