CVE-2026-12848: GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
DNS field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v8 = strlen(gnetworkconfig->dnsaddr);
memcpy(&replybuf[248], gnetworkconfig->dnsaddr, v8);
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12848?
CVE-2026-12848 is rated as critical with a severity score of 10.
How do I fix CVE-2026-12848?
To fix CVE-2026-12848, you should update the GeoVision GV-I/O Box firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-12848?
CVE-2026-12848 is a buffer overflow vulnerability found in the CMD_IP_SET command of the GV-I/O Box.
What affect does CVE-2026-12848 have on device security?
CVE-2026-12848 can allow remote attackers to execute arbitrary code on vulnerable devices due to the buffer overflow.
Is the GV-I/O Box service exposed to the internet for CVE-2026-12848?
Yes, the DVRSearch service in the GV-I/O Box listens for UDP messages on port 10001, potentially exposing it to local network threats.