EUVD-2026-38649
GHSA-gm83-p72p-f6jx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
UDP service reachable on the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); memory corruption yields full code execution on the device, but no clear cross-system scope change, so S:U with C/I/A:H.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
2DescriptionCVE.org
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
DNS field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v8 = strlen(g_network_config->dns_addr);
memcpy(&reply_buf[248], g_network_config->dns_addr, v8);
AnalysisAI
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on the same network to corrupt memory in the DVRSearch service (UDP/10001) by sending a crafted message that triggers an unbounded memcpy of the device's configured DNS address into a fixed-size stack buffer. The flaw is rated CVSS 10.0 with scope change and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation can fully compromise the embedded controller used for relay/I/O automation.
Technical ContextAI
The GV-I/O Box 4E is a network-attached digital I/O controller (4 inputs, 4 relays) addressable over Ethernet and RS-485, identified by CPE cpe:2.3:a:geovision_inc.:gv-i/o_box_4e. Its DVRSearch discovery service listens by default on UDP/10001 and stores a pointer to incoming datagrams (up to 1460 bytes) in a global variable. The root cause is CWE-121 (Stack-based Buffer Overflow): the handler executes memcpy(&reply_buf[248], g_network_config->dns_addr, strlen(g_network_config->dns_addr)) without bounding the source against the remaining space in reply_buf, so attacker-influenced DNS field contents propagate directly onto the stack and can overwrite the saved return address or adjacent control data.
RemediationAI
No vendor-released patch identified at time of analysis in the supplied inputs; monitor the GeoVision security page (https://www.geovision.com.tw/cyber_security.php) and the Talos advisory (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377) for firmware updates and apply the fixed firmware to every GV-I/O Box 4E as soon as it is published. Until a patched firmware is available, isolate the devices on a dedicated management VLAN, block inbound UDP/10001 at the network edge and between user/server VLANs, and restrict the device's reachable peers to the specific GeoVision management host(s) via switch ACLs - the trade-off is that legitimate DVRSearch auto-discovery from other subnets will stop working and the controllers will need to be addressed by static IP. Additionally, lock down the DNS configuration path (use only trusted DHCP servers or set a static DNS value) so an attacker cannot stage a long string into the dns_addr field that the overflow copies onto the stack.
More in Gv I O Box 4E
View allStack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute ar
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute ar
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network servic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today