# CVE-2026-12848: GeoVision GV-I/O Box 4E stack overflow in DVRSearch DNS field

Source: https://junglewise.ai/threats/cve-2026-12848-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-dns-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12848 · Severity: critical · CVSS 10 · Published 2026-06-24

The GeoVision GV-I/O Box 4E, an industrial device used to control physical inputs and relays over a network, contains a critical security flaw in its DVRSearch service. This service, which is active by default, fails to properly check the size of incoming network messages. An attacker can exploit this to take complete control of the device, potentially allowing them to manipulate physical hardware or disrupt operations without needing a password.

Technologies: [Geovision GV-I/O Box 4E](https://junglewise.ai/threats/technologies/gv-i-o-box-4e). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12848 being exploited in the wild.

**How severe is CVE-2026-12848?** Critical severity, with a CVSS score of 10, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-I/O Box 4E 2.09.

**Is there a fix for CVE-2026-12848?** A patch was published on 2026-04-28: Vendor released firmware version 2.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12848 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12848?** Check whether you run Geovision GV-I/O Box 4E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the DVRSearch service of GeoVision GV-I/O Box 4E firmware version 2.09. The service listens for UDP messages on port 10001 and processes them using the CMD_IP_SET functionality. The vulnerability occurs because the application uses 'strlen' on attacker-controlled network configuration strings (specifically the DNS field) and subsequently performs a 'memcpy' into a fixed-size stack buffer (reply_buf) without bounds checking. An unauthenticated attacker can trigger this overflow by sending a crafted UDP packet, leading to arbitrary code execution. The vendor has released firmware version 2.12 to address this issue.

## Affected products

- GeoVision Inc. GV-I/O Box 4E 2.09

## Timeline

- 2026-04-21: disclosed: Initial vendor contact and disclosure by Cisco Talos
- 2026-04-28: patched: Vendor released firmware version 2.12
- 2026-06-24: advisory: Public advisory and CVE publication

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12851-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12850-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E command injection in libNetSetObj.so](https://junglewise.ai/threats/cve-2026-12849-geovision-gv-i-o-box-4e-command-injection-in-libnetsetobj-so)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch gateway field](https://junglewise.ai/threats/cve-2026-12847-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-gateway-field)
- [GeoVision GV-I/O Box 4E stack overflow in DVRSearch net_mask field](https://junglewise.ai/threats/cve-2026-12846-geovision-gv-i-o-box-4e-stack-overflow-in-dvrsearch-net-mask)