Executive brief
The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. This service, which is active by default, fails to properly check the size of incoming network messages. An attacker can exploit this to take complete control of the device, potentially allowing them to manipulate physical hardware or disrupt operations without needing a password.
Technical details
A stack-based buffer overflow (CWE-121) exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001 and processes them using the CMD_IP_SET functionality. The vulnerability occurs because the application uses 'strlen' on attacker-controlled network configuration strings (specifically the DNS field) and subsequently performs a 'memcpy' into a fixed-size stack buffer (reply_buf) without bounds checking. An unauthenticated attacker can trigger this overflow by sending a crafted UDP packet, leading to arbitrary code execution. The vendor has released firmware version 2.12 to address this issue.
Affected products
- GeoVision Inc. GV-I/O Box 4E 2.09
Timeline
- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware version 2.12
- 2026-06-24: advisory: Public advisory and CVE publication