Executive brief
The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. An attacker can send a specially crafted network message to the device to take complete control of it. This could allow an unauthorized user to manipulate physical equipment connected to the box, disrupt operations, or use the device as a foothold to attack other parts of the corporate network.
Technical details
A stack-based buffer overflow exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001. The vulnerability occurs in the CMD_IP_SET functionality where the 'net_mask' field from a received network configuration is copied into a local stack buffer using memcpy() without adequate bounds checking. Specifically, the length is determined by strlen() of the attacker-controlled input and then copied to a fixed offset in 'reply_buf'. An unauthenticated remote attacker can exploit this to overwrite the stack, including the return address, leading to arbitrary code execution with root privileges. A patch was released in firmware version 2.12.
Affected products
- GeoVision Inc. GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware version 2.12
- 2026-06-24: advisory: CVE published to NVD