# CVE-2026-12485: GeoVision GV-I/O Box 4E stack overflow in DVRSearch service

Source: https://junglewise.ai/threats/cve-2026-12485-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12485 · Severity: critical · CVSS 10 · Published 2026-06-24

The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. An unauthenticated attacker can send a specially crafted network message to the device to take complete control of it. This could allow an attacker to disrupt operations, manipulate physical relay outputs, or use the device as a foothold in the corporate network.

Technologies: [Geovision GV-I/O Box 4E](https://junglewise.ai/threats/technologies/gv-i-o-box-4e). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12485 being exploited in the wild.

**How severe is CVE-2026-12485?** Critical severity, with a CVSS score of 10, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-I/O Box 4E 2.09.

**Is there a fix for CVE-2026-12485?** A patch was published on 2026-04-28: Vendor released firmware patch (v2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12485 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12485?** Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001 and fails to properly validate the length of input when processing the CMD_IP_SET command. Specifically, the application uses strlen() on attacker-controlled network configuration strings (such as the IP address, Net Mask, Gateway, and DNS fields) and subsequently performs a memcpy() into a fixed-size local buffer (reply_buf). An unauthenticated remote attacker can exploit this by sending a crafted UDP packet to trigger the overflow, leading to arbitrary code execution with root privileges. The vendor has released firmware version 2.12 to address these vulnerabilities.

## Affected products

- GeoVision Inc. GV-I/O Box 4E 2.09

## Timeline

- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware patch (v2.12)
- 2026-06-24: advisory: Public advisory and CVE publication

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12851-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12850-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12849-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch DNS field](https://junglewise.ai/threats/cve-2026-12848-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-dns-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch gateway field](https://junglewise.ai/threats/cve-2026-12847-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-gateway-field)