64
CVEs
16
Critical
38
High
0
KEV
0
PoC
54
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
16
HIGH
38
MEDIUM
10
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-12485 | Stack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers to corrupt memory via the DVRSearch service on UDP port 10001. The vulnerable code path uses memcpy with an attacker-influenced length derived from a stored IP address into a fixed-size stack buffer, yielding potential remote code execution at CVSS 10.0 with scope change. No public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2377). | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-12846 | Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size stack buffer by sending a crafted UDP packet to the DVRSearch service on port 10001. The flaw, tracked as CWE-121 with a maximum CVSS 10.0 score and scope change, can be triggered by any host able to reach the device on the network, with no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-12847 | Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to corrupt memory by sending a crafted UDP datagram to port 10001. The flaw stems from an unchecked memcpy of the device's configured gateway field into a fixed-offset reply buffer, enabling code execution on the embedded device with no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-12848 | Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on the same network to corrupt memory in the DVRSearch service (UDP/10001) by sending a crafted message that triggers an unbounded memcpy of the device's configured DNS address into a fixed-size stack buffer. The flaw is rated CVSS 10.0 with scope change and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation can fully compromise the embedded controller used for relay/I/O automation. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-57878 | Remote code execution in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the embedded thttpd web server, where overly long parameters in a specific request path overrun a fixed-size stack buffer. An unauthenticated remote attacker (per CVSS PR:N) can send a single crafted HTTP request to corrupt memory and cause denial of service or potentially execute arbitrary code on the device. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and lack of authentication make this a high-priority embedded-device exposure. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-57879 | Remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (V1.12 and earlier) arise from a stack-based buffer overflow in the ssvr component's RTSP custom authentication handling. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker can trigger memory corruption with a single crafted RTSP request, yielding crash-level DoS and potential arbitrary code execution. No public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-57880 | Unauthenticated remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate camera devices (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the ssvr streaming component's RTSP Digest authentication parser. A remote attacker reachable on the RTSP service can send overly long authentication field data to corrupt the stack, crashing the device or potentially executing arbitrary code with no credentials or user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patching target. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-57881 | Remote unauthenticated stack-based buffer overflow in the vlsvr login service of GeoVision GV-LPC2011 and GV-LPC2211 license plate capture cameras (firmware V1.12 and earlier) lets a remote attacker corrupt memory by sending an over-length login field, enabling denial of service and potentially arbitrary code execution. The flaw requires no authentication and no user interaction (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-88278 | Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-88285 | Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward. | CRITICAL | 9.4 | 0.3% | 47 |
No patch
|
| CVE-2026-12486 | OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the libNetSetObj.so library via the DVRSearch service or Network.cgi endpoint. The flaw stems from unsanitized attacker-controlled IP address input passed directly to system() in CNetSetObj::m_F_n_Set_IP_Addr. No public exploit identified at time of analysis, though Talos Intelligence disclosed the issue with technical detail (TALOS-2026-2379). | CRITICAL | 9.1 | 1.7% | 47 |
No patch
|
| CVE-2026-12850 | OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary shell commands via unsanitized gateway address input passed to system() inside libNetSetObj.so. The flaw is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, granting full device compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.1 | 1.7% | 47 |
No patch
|
| CVE-2026-12849 | OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network services to execute arbitrary shell commands via unsanitised netmask input passed to system() inside libNetSetObj.so. The flawed CNetSetObj::m_F_n_Set_Net_Mask routine is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, yielding code execution in the context of the configuration daemon. No public exploit identified at time of analysis, but the Talos report provides full reverse-engineered detail that materially lowers the barrier to weaponisation. | CRITICAL | 9.1 | 1.7% | 47 |
No patch
|
| CVE-2026-12851 | Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the DVRSearch service or Network.cgi endpoint. The flaw lives in libNetSetObj.so where DNS configuration values are concatenated into a shell command string and passed to system() without sanitization. No public exploit identified at time of analysis, but the vendor advisory and a Talos vulnerability report are published. | CRITICAL | 9.1 | 1.7% | 47 |
No patch
|
| CVE-2026-18753 | Hard-coded RSA private key exposure in the GeoVision GV-AS1620 (AS Manager) access-control device lets attackers who extract the firmware-embedded key decrypt and forge the Lighttpd TLS session used for the device's HTTPS management interface. Because the key is static and shared across all units of the same firmware, a single extraction compromises every deployed device, enabling passive traffic decryption and active server impersonation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|