EUVD-2026-38647
GHSA-4774-xxfv-2x4f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Single unauthenticated UDP packet to default-listening service yields code execution; scope kept Unchanged as compromise stays within the device's security authority.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
1DescriptionCVE.org
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
Net Mask field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v6 = strlen(g_network_config->net_mask);
memcpy(&reply_buf[184], g_network_config->net_mask, v6);
AnalysisAI
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size stack buffer by sending a crafted UDP packet to the DVRSearch service on port 10001. The flaw, tracked as CWE-121 with a maximum CVSS 10.0 score and scope change, can be triggered by any host able to reach the device on the network, with no public exploit identified at time of analysis.
Technical ContextAI
The GV-I/O Box 4E is a smart embedded I/O controller (4 inputs, 4 relay outputs) reachable over Ethernet and RS-485, identified by cpe:2.3:a:geovision_inc.:gv-i/o_box_4e. It runs a DVRSearch service that listens by default on UDP/10001 and accepts up to 1460 bytes per datagram into a buffer whose pointer is held in a global variable. The vulnerable code path computes strlen(g_network_config->net_mask) on attacker-controlled data and then performs a memcpy into reply_buf[184] on the stack without validating the length, which is the textbook CWE-121 stack-based buffer overflow pattern; because the bounded source size (1460) far exceeds the destination region, return addresses and saved registers are reachable from the overflow.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the GeoVision security page at https://www.geovision.com.tw/cyber_security.php and the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377 for fixed firmware. Until patched firmware is available, restrict reachability of UDP/10001 to a strict allowlist of management hosts using upstream ACLs or a firewall, place the device on a dedicated OT VLAN segmented from corporate and Internet traffic, and disable or filter the DVRSearch discovery service at the network edge; the trade-off is that legitimate discovery and management tools that rely on UDP/10001 broadcasts will need to operate from the allowlisted segment, so deployments using GeoVision's auto-discovery utilities will require manual configuration of device IPs.
More in Gv I O Box 4E
View allStack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on th
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute ar
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute ar
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network servic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today