CVE-2026-12848

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### DNS field stack overflow The following code is vulnerable to a stack overflow that is attacker-controlled: v8 = strlen(g_network_config->dns_addr); memcpy(&reply_buf[248], g_network_config->dns_addr, v8);

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377
https://www.geovision.com.tw/cyber_security.php

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-24 05:17

Updated : 2026-06-25 14:02

NVD link : CVE-2026-12848

Mitre link : CVE-2026-12848

CVE.ORG link : CVE-2026-12848

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-12848", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12848", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T12:46:58.574812Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "affectedData": [{"vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "versions": [{"status": "affected", "version": "V2.09"}, {"status": "unaffected", "version": "v2.12"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T05:17:26.710", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}, {"url": "https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.\n\nDVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. \n\n\n\nUpon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:\n\n\n\n#### DNS field stack overflow\n\nThe following code is vulnerable to a stack overflow that is attacker-controlled:\n\n\n\n v8 = strlen(g_network_config->dns_addr);\n\n memcpy(&reply_buf[248], g_network_config->dns_addr, v8);"}], "lastModified": "2026-06-25T14:02:35.347", "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9"}