CVE Intelligence
Analysis AI-assisted

CVE-2026-12485: GeoVision GV-I/O Box 4E DVRSearch Stack-Based Buffer Overflow

CVE-2026-12485 is a stack-based buffer overflow (CWE-121) in the DVRSearch UDP service of the GV-I/O Box 4E embedded device, as described in the record. According to the record, the service runs by default and can be reached by any user on the network. The CNA-provided CVSS vector rates it critical, but the record lists no affected or fixed versions and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a stack-based buffer overflow (CWE-121) in the DVRSearch service of the GV-I/O Box 4E, an embedded device with 4 inputs and 4 relay outputs that can be controlled over Ethernet and RS-485. According to the record, the service runs by default and listens for UDP messages on port 10001, so any user on the network can interact with it.

Impact

The provided CVSS vector indicates network attack with no privileges or user interaction, with high confidentiality, integrity and availability impact and a changed scope. The critical score follows from that vector. Consequences beyond the vector are not described in the available data.

Affected products and versions

  • The record identifies the product as the GV-I/O Box 4E.
  • No affected version ranges are listed in the record.
  • No fixed versions are listed in the record. This does not mean that no fix exists.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the vendor security page referenced in the record: GeoVision cyber security.
  • Until a vendor fix is confirmed, restrict network access to the device and limit access to UDP port 10001 to trusted management hosts.
  • Keep these devices off untrusted and general user networks, and segment them from other systems.

Detection guidance

  • Review network logs for UDP traffic to port 10001 on these devices from hosts that should not manage them.
  • Monitor for unexpected device reboots, crashes or service restarts, which may indicate abnormal input handling.
  • Maintain an inventory of GV-I/O Box 4E devices and their firmware levels.

Limitations of the available information

  • The record does not include affected or fixed versions, vendor advisory content or exploitation evidence.
  • The referenced Talos report was not analyzed beyond the record's reference list.
  • The vendor association with GeoVision is inferred from the product name and the vendor URL in the record.

Frequently asked questions

What is CVE-2026-12485?

It is a stack-based buffer overflow (CWE-121) in the DVRSearch UDP service of the GV-I/O Box 4E, according to the record.

Is this CVE being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected and is there a fix?

The record lists no affected or fixed versions. The absence of fixed versions does not mean no fix exists, so check the vendor security page.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.