CVE-2026-12485: GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command

Synopsis

A stack-based buffer overflow affects the GeoVision GV-I/O Box 4E firmware, specifically in the DVRSearch service that listens for UDP messages on port 10001. The service is reachable by any host on the network with no authentication required, and exploitation requires no user interaction. Successful exploitation gives an attacker full control over the device, including reading sensitive data, modifying configuration, and crashing or taking over the service. A patched-image rebuild at v2.12 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device over the network; DVRSearch listens on UDP port 10001 and is exposed to any host on the local or routed network without further access control.

• AuthenticationNot required

  No credentials or session token are needed; the DVRSearch service accepts and processes UDP messages from any sender.

• Victim interactionNot required

  The exploit is fully automated and requires no action from a user or administrator on the target device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sends a crafted UDP packet and the overflow occurs deterministically on any unpatched device.

Blast Radius

• An attacker reads sensitive data stored on or accessible to the device, such as network configuration and credentials held in memory.
• An attacker writes arbitrary values into the stack and gains control of the instruction pointer, enabling remote code execution on the embedded firmware.
• An attacker modifies device configuration, including IP settings and relay output states, disrupting physical or logical systems the device controls.
• An attacker crashes the DVRSearch service or the entire device, denying legitimate access and potentially disrupting connected physical hardware.