GeoVision GV-VMS CVE-2026-12488

Exploitation requires the attacker to occupy a network-intercept position capable of impersonating the GeoVision GV-Cloud server - specifically achievable through ARP spoofing on the same LAN segment as the GV-VMS host, DNS cache poisoning targeting the cloud server hostname, BGP-level route injection, or deployment of a rogue access point. The GV-Cloud feature must be enabled and the VMS must be actively initiating or maintaining a connection to the cloud server at the time of attack. UI:R indicates a user-driven or scheduled event (such as a login, sync, or keepalive cycle) must trigger the connection. The vendor-assigned PR:H metric suggests an undocumented authentication prerequisite that is not explained by the description - teams should verify with GeoVision whether VMS admin credentials or OS-level access are required before triggering the vulnerable path. Deployments that do not use GV-Cloud connectivity are not affected.

The vendor-assigned CVSS 3.1 score of 6.2 (Medium) reflects genuinely constrained attack conditions: AV:N confirms the attack is network-reachable, but AC:H (attacker must successfully impersonate the cloud server) materially limits the realistic attacker pool to those capable of DNS poisoning, ARP spoofing, rogue-AP deployment, or network-path hijacking. The PR:H metric assigned by the vendor is in tension with the described impersonation attack, which typically maps to PR:N - teams should clarify with GeoVision whether additional authentication is actually required. UI:R further constrains exploitation to windows when the VMS initiates a cloud connection. S:C and A:H together indicate that a successful exploit does not merely affect the GV-Cloud component in isolation but crashes the broader VMS process, taking down all camera feeds and recording. EPSS data is absent from the provided input and cannot be cited numerically. No CISA KEV listing and no public exploit code are identified, making this a medium-priority hardening item rather than an emergency patch. Operational risk is elevated in physical-security contexts where camera downtime directly impacts safety and compliance.

An attacker positioned on the network path between a GV-VMS host and the GeoVision cloud endpoint - via ARP poisoning on a shared LAN segment, DNS hijacking, or rogue Wi-Fi access point - intercepts an outbound cloud connection initiated by the VMS software. The attacker responds with a specially crafted network payload that exceeds the stack buffer allocated for server response handling, corrupting the call stack and crashing the GV-VMS process. The result is immediate loss of all camera feeds, motion detection, alarm handling, and video recording until the service is manually restarted. No public exploit code has been identified at time of analysis, though the Cisco Talos report (TALOS-2026-2411) indicates the vulnerability has been researched to a level sufficient for detailed characterization.