0xBlackash/CVE-2026-12485

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script and README that check for the presence of the vulnerable DVRSearch service on UDP port 10001 by sending benign probes and observing responses, without triggering the buffer overflow.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python script (CVE-2026-12485.py) and a README.md. The script sends benign UDP probes to port 10001 to detect the DVRSearch service and performs a safe length test with small payloads. It does not contain any backdoor, deceptive payload, or concealed harmful behavior. The README provides documentation and expected output. No obfuscation, persistence, credential theft, or unrelated remote access is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareGeoVision GV-I/O Box 4E DVRSearch service
Attack typesStack-based buffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script explicitly states it is a 'Safe Vulnerability Checker' that 'does NOT exploit the vulnerability' and only sends benign probes to detect the service. It does not contain code to trigger the stack overflow or execute arbitrary code, making it a scanner.

CVE-2026-12485.py:3-8CVE-2026-12485.py:91README.md:198

Requirements

  • Network access to target device on UDP port 10001CVE-2026-12485.py:21-25

Observed behavior

  • Sends a safe UDP probe with a short IP address and padding to port 10001CVE-2026-12485.py:27-34
  • Receives and displays a response if the service is activeCVE-2026-12485.py:36-40
  • Optionally performs a safe length test by sending incrementally larger but non-crashing payloadsCVE-2026-12485.py:51-78
  • Prints recommendations to update firmware and restrict access if service respondsCVE-2026-12485.py:98-103
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
UDP probes to port 10001 with hardcoded payloadsThe script sends safe, non-exploitative UDP packets to detect the vulnerable service. This is consistent with the stated purpose of a vulnerability checker.CVE-2026-12485.py:29-34CVE-2026-12485.py:61-66
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no binary or network captures are included.
  • The script's actual behavior on a live target is not observed; classification is based solely on static code analysis.
  • Only the two text files (CVE-2026-12485.py and README.md) were reviewed; no other files exist in the repository snapshot.
  • The analysis does not execute the code, so runtime behavior is not verified, but static analysis shows no malicious intent.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1