EUVD-2026-38647
GHSA-4774-xxfv-2x4f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify GV-I/O Box on UDP/10001
-
DeliveryCraft DVRSearch packet with oversized net_mask
-
ExploitSend single UDP datagram to device
-
InstallOverflow stack via unchecked memcpy
-
C2Overwrite saved return address
-
ExecuteExecute shellcode as DVRSearch service
-
ImpactPivot to relay/OT control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The DVRSearch service must be running and reachable on UDP/10001, which is the default configuration on GV-I/O Box 4E - no authentication, user interaction, or non-default settings are required. Limiting factors are purely network-positional: the attacker needs IP reachability to UDP/10001 on the device, which in typical deployments means presence on the same OT/management VLAN or a routed path through a firewall that does not block UDP/10001; there is no platform, version, or configuration toggle in the description that gates exploitation. |
| Impact | All signals converge on high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H means a single unauthenticated UDP packet from anywhere with network reach to the device yields full compromise with scope change. EPSS and SSVC data were not supplied in the input, and the device is not on CISA KEV, so probabilistic exploitation likelihood cannot be quantified. No POC has been identified at time of analysis, but the Talos advisory typically includes triggering details and the bug is mechanically simple (oversized net mask string in a parsed UDP message), making weaponization low-effort; the primary mitigating factor is that these I/O controllers are usually deployed on isolated OT/integrator networks rather than the public Internet, which limits exposure but does not reduce per-device severity. |
| Exploit ScenarioDerived | An attacker on the same Layer 2 segment, VPN, or any routed network with reach to UDP/10001 sends a single crafted DVRSearch packet whose embedded net_mask field is a long attacker-controlled string. The memcpy at reply_buf[184] overflows the stack, overwriting the saved return address to redirect execution into shellcode placed elsewhere in the 1460-byte payload, granting code execution on the device with the privileges of the DVRSearch daemon; no public exploit was identified at time of analysis but the primitive is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size stack buffer by sending a crafted UDP packet to the DVRSearch service on port 10001. The flaw, tracked as CWE-121 with a maximum CVSS 10.0 score and scope change, can be triggered by any host able to reach the device on the network, with no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the GeoVision security page at https://www.geovision.com.tw/cyber_security.php and the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377 for fixed firmware. Until patched firmware is available, restrict reachability of UDP/10001 to a strict allowlist of management hosts using upstream ACLs or a firewall, place the device on a dedicated OT VLAN segmented from corporate and Internet traffic, and disable or filter the DVRSearch discovery service at the network edge; the trade-off is that legitimate discovery and management tools that rely on UDP/10001 broadcasts will need to operate from the allowlisted segment, so deployments using GeoVision's auto-discovery utilities will require manual configuration of device IPs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The GV-I/O Box 4E is a smart embedded I/O controller (4 inputs, 4 relay outputs) reachable over Ethernet and RS-485, identified by cpe:2.3:a:geovision_inc.:gv-i/o_box_4e. It runs a DVRSearch service that listens by default on UDP/10001 and accepts up to 1460 bytes per datagram into a buffer whose pointer is held in a global variable. The vulnerable code path computes strlen(g_network_config->net_mask) on attacker-controlled data and then performs a memcpy into reply_buf[184] on the stack without validating the length, which is the textbook CWE-121 stack-based buffer overflow pattern; because the bounded source size (1460) far exceeds the destination region, return addresses and saved registers are reachable from the overflow.
Know when Gv I O Box 4E gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Single unauthenticated UDP packet to default-listening service yields code execution; scope kept Unchanged as compromise stays within the device's security authority.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
DescriptionCVE.org
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
Net Mask field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v6 = strlen(g_network_config->net_mask);
memcpy(&reply_buf[184], g_network_config->net_mask, v6);
Executive ViewAI
The GeoVision GV-I/O Box 4E contains a critical stack-based buffer overflow vulnerability (CVE-2026-12846, CVSS 10.0) allowing unauthenticated attackers to execute arbitrary code via crafted network packets. Organizations deploying these surveillance and I/O control devices face immediate risk of total system compromise, loss of surveillance capabilities, and potential lateral movement to connected infrastructure. The absence of a vendor patch creates an urgent security posture issue requiring immediate containment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement firewall rules restricting access to port 10001 (DVRSearch) from untrusted networks; (2) Isolate affected devices to a segmented network with restricted inter-VLAN routing; (3) Monitor network traffic for suspicious UDP activity targeting the device; (4) Disable external/remote access to affected systems; (5) Evaluate device replacement pending vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB