CVE-2026-4606 | BDVDB-2026-322005 Detail

Description#

GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.  During installation, ERM creates a Windows service that runs under the LocalSystem account.  When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.  Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.  Any ERM function invoking Windows file open/save dialogs exposes the same risk.  This vulnerability allows local privilege escalation and may result in full system compromise.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-23Record published in the CVE List.
2. Version 22026-03-24Most recent update recorded in the CVE List.