CVE-2026-108983: GeoVision GV-ASManager Unauthenticated OS Command Injection

Overview

A critical vulnerability has been disclosed in GeoVision GV-ASManager, an access-control management application published by Taiwanese security-hardware vendor GeoVision Inc. Tracked as CVE-2026-108983 with a maximum-severity CVSS score of 9.8, the flaw sits in the product's web server component, which runs under the process name GeoWebServer.exe.

The official NVD record for this CVE is unusually thin, consisting of a single sentence: "A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe." The additional specifics below — product version, root cause, and CVSS vector — come from third-party vulnerability trackers (vulners.com, Strix, and the EU Vulnerability Database) that have indexed the same underlying advisory; they were not independently verified against a GeoVision-published bulletin, since GeoVision's general security-advisories page did not surface CVE-specific content at the time of writing. Treat the version and root-cause detail accordingly.

Technical Details

What the NVD Record Actually Says

Beyond the CVE ID, CVSS score, and publish date, the authoritative NVD description gives almost nothing to work with — no attack chain, no discoverer, no confirmed version range. The phrasing style ("a vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe") reads like a terse, auto-translated summary of a vendor or national-CERT advisory rather than original NVD analysis, which is common for CVEs affecting hardware and access-control vendors outside the US/EU.

What Third-Party Trackers Add

Aggregators that index the same disclosure describe this as a command injection vulnerability in GV-ASManager's web server, reachable through the default ports that GeoWebServer.exe listens on, requiring no authentication and no user interaction. A related, lower-severity CVE — CVE-2026-108984, a stack-based buffer overflow (CWE-121) rated CVSS 7.5 — was disclosed the same day against the same component and version, which is consistent with both issues being found during the same security review of GeoWebServer.exe.

Impact Assessment

GV-ASManager is access-control management software, meaning deployments typically sit on networks that also control physical access systems (door controllers, badge readers, and related building-security infrastructure). A network-reachable, unauthenticated command-injection flaw in such software is high-impact by nature: successful exploitation could give an attacker code execution on the host running GeoWebServer.exe, with downstream risk to any access-control hardware that host manages.

Organizations running GV-ASManager 6.3.0 with the web server component exposed — particularly to untrusted networks or the public internet — should treat this as an urgent patching priority given the CVSS 9.8 score, network attack vector, and lack of any authentication requirement.

No proof-of-concept exploit or confirmed in-the-wild exploitation has been identified in public sources as of publication, and the vulnerability does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Mitigation

Immediate Actions

• Upgrade GV-ASManager to version 6.4.0 or later, which third-party trackers list as the fixed release
• Restrict network access to the GeoWebServer.exe default connection ports to trusted management networks only — do not expose this service to the internet
• Where immediate patching isn't possible, consider isolating the GV-ASManager host on a segmented VLAN with tightly controlled inbound access until the upgrade is complete

Detection Opportunities

• Review logs on hosts running GeoWebServer.exe for unexpected child processes or command execution originating from the web server process
• Monitor network traffic to GV-ASManager's default web server ports for anomalous or unauthenticated request patterns
• Inventory all GeoVision GV-ASManager deployments in your environment and confirm installed version against 6.4.0

Defence-in-Depth

• Apply the principle of least exposure to any access-control management software — these systems should never be directly reachable from untrusted networks
• Maintain a current asset inventory of physical-security and access-control software so that disclosures like this one can be triaged quickly against actual deployments

Sources & Confidence

This advisory is written from the published NVD record plus secondary reporting; no GeoVision-authored bulletin specific to CVE-2026-108983 was located at time of writing. The CWE classification, affected/fixed version numbers, and CVSS vector string should be treated as third-party-reported, not vendor-confirmed, and verified against GeoVision's own advisory if one becomes available.

References

• NVD — CVE-2026-108983
• Strix — CVE-2026-108983: GV-ASManager OS Command Injection
• vulners.com — NVD:CVE-2026-108983
• GeoVision Cyber Security Advisories (general page)