Is CVE-2026-12485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12485 being exploited in the wild.

How severe is CVE-2026-12485?

Critical severity, with a CVSS score of 10, published 24 June 2026.

Is there a fix for CVE-2026-12485?

A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12485 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12485?

Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12485: GeoVision GV-I/O Box 4E stack overflow in DVRSearch service

CVE-2026-12485 · Severity: critical · CVSS 10 · Published 2026-06-24

The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. An unauthenticated attacker can send a specially crafted network message to the device to take complete control of it. This could allow an attacker to disrupt operations, manipulate physical relay outputs, or use the device as a foothold in the corporate network.

Technologies: Geovision GV-I/O Box 4E. Vendors: Geovision.

Quick answers

Is CVE-2026-12485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12485 being exploited in the wild.
How severe is CVE-2026-12485?: Critical severity, with a CVSS score of 10, published 24 June 2026.
Which products and versions are affected?: Geovision GV-I/O Box 4E 2.09.
Is there a fix for CVE-2026-12485?: A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12485 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12485?: Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001 and fails to properly validate the length of input when processing the CMD_IP_SET command. Specifically, the application uses strlen() on attacker-controlled network configuration strings (such as the IP address, Net Mask, Gateway, and DNS fields) and subsequently performs a memcpy() into a fixed-size local buffer (reply_buf). An unauthenticated remote attacker can exploit this by sending a crafted UDP packet to trigger the overflow, leading to arbitrary code execution with root privileges. The vendor has released firmware version 2.12 to address these vulnerabilities.

Affected products

GeoVision Inc. GV-I/O Box 4E 2.09

Timeline

2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
2026-04-28: patched: Vendor released firmware patch (v2.12)
2026-06-24: advisory: Public advisory and CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.