{"id":"CVE-2026-4606","aliases":["EUVD-2026-14346","GHSA-4rcj-4mww-76cq"],"status":"published","title":"GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege","description":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:I/V:C/RE:M/U:Green","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00284,"percentile":0.21031,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-250"],"published":"2026-03-23T01:05:31Z","modified":"2026-06-17T10:56:54Z","products":[{"vendor":"geovision","product":"gv-edge recording manager"}],"references":[{"url":"https://https://www.geovision.com.tw/cyber_security.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4606"},{"url":"https://github.com/advisories/GHSA-4rcj-4mww-76cq"}],"sources":{"cve":[{"id":"CVE-2026-4606","title":"GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege","description":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise.","status":"published","published":"2026-03-23T01:05:31.952Z","modified":"2026-03-24T03:56:02.798Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:I/V:C/RE:M/U:Green","level":"critical","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:19:59.369956Z"}],"euvd":[{"id":"EUVD-2026-14346","description":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise.","status":"published","published":"2026-03-23T01:05:31Z","modified":"2026-03-24T03:56:02Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:I/V:C/RE:M/U:Green","level":"critical"}],"updated_at":"2026-11-02T19:25:30.317985Z"}],"ghsa":[{"id":"GHSA-4rcj-4mww-76cq","title":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level...","description":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise.","status":"published","published":"2026-03-23T03:31:39Z","modified":"2026-03-23T03:31:45Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green","level":"critical"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:06:47.173687Z"}],"nvd":[{"id":"CVE-2026-4606","description":"GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise.","status":"published","published":"2026-03-23T02:16:05.213Z","modified":"2026-06-17T10:56:54.44Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green","level":"critical","assessor":"secondary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:12:10.568062Z"}]}}