From Viewer to SYSTEM: Critical 10.0 CVSS Flaw in GeoVision ERM Allows Full Host Takeover

GeoVision disclosed a critical local privilege escalation vulnerability (CVE-2026-4606, CVSS v4 10.0) in GV-Edge Recording Manager (V2.3.1 and earlier) where processes are spawned under the Windows Local System account; functions that invoke Windows file dialogs can be abused by a low-privileged local user to access, modify, or delete protected system files, potentially resulting in full system compromise. GeoVision released a patch in V2.3.2 and administrators are urged to upgrade immediately.