Vulnerability Description
GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. Any ERM function invoking Windows file open/save dialogs exposes the same risk. This vulnerability allows local privilege escalation and may result in full system compromise.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-4606?
CVE-2026-4606 is a documented vulnerability. GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation,...
How severe is CVE-2026-4606?
CVSS scoring is not yet available for CVE-2026-4606. Check NVD for updates.
Is there a patch for CVE-2026-4606?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.