🚨 CVE-2026-12485 - Critical Unauthenticated Remote Code Execution (RCE)

GeoVision GV-I/O Box 4E – Firmware v2.09

Disclosure Date: June 23, 2026
CWE: CWE-121 – Stack-Based Buffer Overflow
Attack Vector: Network (Unauthenticated)

---

An unauthenticated stack-based buffer overflow vulnerability in the DVRSearch service of the GeoVision GV-I/O Box 4E allows remote attackers to achieve arbitrary code execution and fully compromise affected devices.

📋 Overview

🎯 Affected Products

🔍 Vulnerability Details

The vulnerability resides within the CMD_IP_SET functionality of the DVRSearch service. An unsafe memcpy() operation copies user-controlled data into a fixed-size stack buffer without validating the length of the source input.

v3 = strlen(g_network_config->ip_addr);
memcpy(&reply_buf[36], g_network_config->ip_addr, v3);

Because the destination buffer boundaries are not enforced, a specially crafted request can trigger a stack buffer overflow, potentially allowing an attacker to overwrite execution flow and execute arbitrary code.

⚠️ Impact

Successful exploitation may allow an attacker to:

• Execute arbitrary code remotely.
• Gain complete control over the device.
• Disrupt connected physical security or industrial systems.
• Establish persistence and pivot further into the network.

📊 CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score: 10.0 (Critical)

🛡️ Mitigation

• Identify all devices running firmware v2.09.
• Restrict access to the management interface.
• Place devices behind a firewall or VPN.
• Avoid exposing affected devices directly to the Internet.
• Apply vendor security updates as soon as they become available.
• Monitor network traffic for suspicious requests targeting DVRSearch.

🔎 Detection Recommendations

• Unexpected crashes or reboots of the device.
• Anomalous traffic to the DVRSearch service.
• Repeated requests involving network configuration functions.
• Signs of unauthorized configuration changes.

📅 Timeline

📚 References

• Cisco Talos Security Advisory
• GeoVision Security Advisories
• MITRE CVE Database

✅ Expected Output When the Script Works

Here's what you should see when running the checker:

Normal Successful Run (Service Detected)

$ python3 CVE-2026-12485-check.py 192.168.1.100
============================================================
Safe CVE-2026-12485 (GV-I/O Box 4E DVRSearch) Checker
============================================================
Target: 192.168.1.100:10001
This script does NOT exploit the vulnerability.

[+] Sending safe probe to 192.168.1.100:10001 ...
[+] Received response (XXX bytes) from ('192.168.1.100', 10001)
[+] Service appears active. Response preview: b'\x00\x00...'

============================================================
Recommendation:
- If service responds → Update firmware immediately (GV-IOBOX_2026-06-01).
- Block UDP/10001 from untrusted sources.
- Full advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377
============================================================

With --length-test Option

You’ll see additional lines like:

[+] Performing safe length test (non-crashing)...
    Testing payload size: 54 bytes...
    [+] Size 54 -> Response received (XXX bytes)
    Testing payload size: 104 bytes...
    [+] Size 104 -> Response received (XXX bytes)
    ...

Other Possible Outputs

What Does "It Works" Mean?

• If you see "Service appears active" → The DVRSearch service is exposed → High risk of CVE-2026-12485.
• The device is likely vulnerable unless it has the latest patched firmware.

Next Steps if it responds:

1. Immediately update the firmware from GeoVision.
2. Restrict access to UDP port 10001.
3. Consider network segmentation for the device.