CVE-2026-4606: GeoVision Gv-Edge Recording Manager

Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days.

GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.  During installation, ERM creates a Windows service that runs under the LocalSystem account.  When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.  Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.  Any ERM function invoking Windows file open/save dialogs exposes the same risk.  This vulnerability allows local privilege escalation and may result in full system compromise.

Affected products

• GeoVision Gv-Edge Recording Manager: version 2.3.1 only

Published 2026-03-23. Last modified 2026-06-17.