EUVD-2026-38648
GHSA-6hhf-75q4-5pc2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated UDP service on the network with a trivially triggered stack overflow yielding code execution that crosses from the service to the device OS, justifying S:C and full C/I/A:H.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
1DescriptionCVE.org
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
Gateway field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v7 = strlen(g_network_config->gateway);
memcpy(&reply_buf[216], g_network_config->gateway, v7);
AnalysisAI
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to corrupt memory by sending a crafted UDP datagram to port 10001. The flaw stems from an unchecked memcpy of the device's configured gateway field into a fixed-offset reply buffer, enabling code execution on the embedded device with no public exploit identified at time of analysis.
Technical ContextAI
The GV-I/O Box 4E is a smart embedded I/O controller (4 inputs / 4 relay outputs) addressable over Ethernet and RS-485 (cpe:2.3:a:geovision_inc.:gv-i/o_box_4e). It runs a DVRSearch discovery service that listens for UDP messages on port 10001 and reads up to 1460 bytes into a local stack buffer whose pointer is cached in a global. CWE-121 (stack-based buffer overflow) applies here because the reply construction calls memcpy(&reply_buf[216], gateway, strlen(gateway)) using the attacker-influenced gateway string from the network configuration without bounding the destination size, so an overlong gateway value smashes the return address and adjacent stack frame.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the GeoVision cybersecurity page at https://www.geovision.com.tw/cyber_security.php and TALOS-2026-2377 at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377 for firmware updates and apply the fixed image as soon as it is published. As compensating controls, block inbound UDP/10001 at perimeter and segmentation firewalls so DVRSearch is reachable only from a trusted management VLAN (side effect: legitimate discovery tools running outside that VLAN will stop locating the device), and harden the device's network configuration so the gateway field cannot be set by untrusted operators since that string is the payload sink. Where possible, place the I/O Box behind a NAT or one-way industrial DMZ rather than directly on the user LAN, accepting that remote management workflows will need to be reworked.
More in Gv I O Box 4E
View allStack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on th
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute ar
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute ar
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network servic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today