CVE-2026-12485

🚨 CVE-2026-12485 - 严重未授权远程代码执行 RCE GeoVision GV-I/O Box 4E – 固件 v2.09 披露日期： 2026年6月23日 CWE： CWE-121 – 基于栈的缓冲区溢出 攻击向量： 网络（未授权） GeoVision GV-I/O Box 4E 的 DVRSearch 服务中存在一个未授权的基于栈的缓冲区溢出漏洞，允许远程攻击者实现任意代码执行并完全控制受影响的设备。 📋 概述 字段| 值 ---|--- CVE ID| CVE-2026-12485 CVSS v3.1| 10.0（严重） CWE| CWE-121 受影响产品|...

CVE-2026-12848

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with i...

CVE-2026-12846

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with i...

PT-2026-51660

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09 Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially...