Security Advisory - Published 2026-06-24 - GeoVision
GeoVision GV-I/O Box 4E: isolate exposed devices and review relay changes
The June 2026 GeoVision GV-I/O Box 4E batch covers critical device-side issues reported by Cisco Talos. Treat internet or guest-network exposure as urgent. The practical work is asset inventory, network isolation, firmware review, and checking whether relay or network settings changed without an approved maintenance window.
Affected device batch
| CVE | Device | Review | CVSS |
|---|---|---|---|
| CVE-2026-12485 | GV-I/O Box 4E | DVRSearch service | 10.0 |
| CVE-2026-12846 | GV-I/O Box 4E | network settings | 10.0 |
| CVE-2026-12847 | GV-I/O Box 4E | gateway settings | 10.0 |
| CVE-2026-12848 | GV-I/O Box 4E | DNS settings | 10.0 |
| CVE-2026-12486 | GV-I/O Box 4E | network changes | 9.1 |
| CVE-2026-12849 | GV-I/O Box 4E | netmask changes | 9.1 |
| CVE-2026-12850 | GV-I/O Box 4E | gateway changes | 9.1 |
| CVE-2026-12851 | GV-I/O Box 4E | DNS changes | 9.1 |
Owner self-check
- Inventory every GV-I/O Box 4E from physical labels, DHCP leases, firewall objects, and site documentation.
- Confirm whether management or device discovery traffic is reachable from the internet, guest Wi-Fi, VPN users, or shared office networks.
- Check GeoVision firmware guidance for the exact model and schedule a controlled maintenance window.
- Review relay activation history, input events, network settings, DNS settings, gateway changes, and device reboots.
- Compare firewall logs against expected management stations and remove broad allow rules.
Safe containment path
- Move the device behind a restricted management VLAN or firewall rule before reviewing it.
- Block access from the public internet and from user networks that do not need device management.
- Preserve firewall, DHCP, and device logs before factory reset or firmware work.
- Apply vendor firmware guidance, then rotate device credentials and update documentation.
- Recheck relay behavior after the change window so physical controls match the expected state.
Signs that need deeper review
- Relay activations, input events, device restarts, or network setting changes without a ticket.
- Firewall logs from unknown source networks, VPN accounts, or shared subnets.
- DNS, gateway, or IP settings that no longer match the site network plan.
- Devices reachable from search engines, public IP ranges, or vendor-remote access rules that were not approved.
Repair help
Use Ping7 CVE Repair when an exposed physical security device needs isolation planning, firewall review, log preservation, or a compromise review before it is returned to production.