Executive brief
The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. An unauthenticated attacker can send a specially crafted network message to the device to take complete control of it. This could allow an attacker to disrupt operations, manipulate physical relay outputs, or use the device as a foothold in the corporate network.
Technical details
A stack-based buffer overflow exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001 and fails to properly validate the length of input when processing the CMD_IP_SET command. Specifically, the application uses strlen() on attacker-controlled network configuration strings (such as the IP address, Net Mask, Gateway, and DNS fields) and subsequently performs a memcpy() into a fixed-size local buffer (reply_buf). An unauthenticated remote attacker can exploit this by sending a crafted UDP packet to trigger the overflow, leading to arbitrary code execution with root privileges. The vendor has released firmware version 2.12 to address these vulnerabilities.
Affected products
- GeoVision Inc. GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware patch (v2.12)
- 2026-06-24: advisory: Public advisory and CVE publication