EUVD-2026-38646
GHSA-x4j6-xvjv-qp6p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Single unauthenticated UDP packet triggers stack overflow on a discovery service; full RCE on an embedded device whose relays affect a separate physical/OT scope justifies S:C and C/I/A:H.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
1DescriptionCVE.org
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
IP field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v3 = strlen(g_network_config->ip_addr);
memcpy(&reply_buf[36], g_network_config->ip_addr, v3);
AnalysisAI
Stack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers to corrupt memory via the DVRSearch service on UDP port 10001. The vulnerable code path uses memcpy with an attacker-influenced length derived from a stored IP address into a fixed-size stack buffer, yielding potential remote code execution at CVSS 10.0 with scope change. No public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2377).
Technical ContextAI
The GV-I/O Box 4E is a smart embedded device exposing four digital inputs and four relay outputs over Ethernet and RS-485, commonly deployed alongside GeoVision DVR/NVR ecosystems for access control and alarm integration. Its DVRSearch discovery service binds UDP/10001 and copies up to 1460 bytes from incoming datagrams into a local buffer, then later builds a reply by memcpy'ing the device's configured ip_addr string into reply_buf[36] using strlen() as the length. Because the ip_addr field is itself derived from attacker-controlled network input, the strlen-derived length is not bounded against the destination size, producing the classic CWE-121 stack-based buffer overflow with linear adjacent stack corruption (return address, saved registers, canaries if any).
RemediationAI
No vendor-released patch identified at time of analysis from the provided data; consult the GeoVision cybersecurity advisory at https://www.geovision.com.tw/cyber_security.php and the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377 for firmware updates as they become available, and apply the fixed firmware to all GV-I/O Box 4E units once released. As compensating controls, place the devices on an isolated management VLAN and block ingress UDP/10001 at the firewall except from the specific GeoVision DVR/NVR controllers that legitimately use DVRSearch - this breaks discovery from third-party tools but eliminates the network exposure. Where discovery must remain available, restrict UDP/10001 with strict source-IP allowlists on the upstream switch or router ACL, accepting the trade-off that any spoofed UDP source within the allowlist could still reach the service.
More in Gv I O Box 4E
View allRemote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on th
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute ar
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute ar
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network servic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today