CVE-2026-108983

{
  "etk_id": "ETK-2026-2027",
  "cve_id": "CVE-2026-108983",
  "display_id": "CVE-2026-108983",
  "ghsa_id": "GHSA-4688-jpp9-vr89",
  "euvd_id": "EUVD-2026-104030",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Command injection in GeoVision GV-ASManager web server",
  "summary": "GV-ASManager deployments using the GeoWebServer.exe web service may be vulnerable to command injection through its default network ports. An unauthenticated remote attacker may be able to execute commands if they can reach the exposed service.",
  "mitigation": "Restrict access to the GeoWebServer.exe default ports to trusted administrative networks and remove public exposure. No fixed version is recorded; apply a vendor-provided update when one becomes available.",
  "vendor": "GeoVision Inc.",
  "product": "GV-ASManager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "6.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "GV-ASManager",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2286,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 74.97478251666666,
  "t0_at": "2026-10-19T00:51:53.770000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T00:51:53.770000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T00:51:53.770000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108983"
    }
  }
}