Executive brief
The GeoVision GV-I/O Box 4E, an industrial controller used to manage physical inputs and relays over a network, contains a critical security flaw. An attacker can send a specially crafted network message to the device's discovery service to take complete control of the hardware. This could allow unauthorized parties to manipulate physical equipment, disrupt operations, or gain a foothold in the corporate network.
Technical details
A stack-based buffer overflow (CWE-121) exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001. When processing the CMD_IP_SET command, the application fails to validate the length of the 'gateway' field before copying it into a fixed-size local buffer using memcpy. An unauthenticated attacker on the network can send a crafted UDP packet to overflow the stack, leading to arbitrary code execution with root privileges. This is one of several similar overflows (including IP, Net Mask, and DNS fields) identified in the same component. A patch was released in version 2.12.
Affected products
- GeoVision Inc. GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware version 2.12 to address the issue
- 2026-06-24: advisory: Public advisory and CVE publication