CVE-2026-12846: GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command

Synopsis

A stack-based buffer overflow exists in the DVRSearch service of the GeoVision GV-I/O Box 4E embedded device, specifically triggered by a crafted CMD_IP_SET UDP message sent to port 10001. The service is reachable over the network with no authentication required, and any host that can send UDP packets to the device can trigger the flaw. Successful exploitation gives an attacker full control over the affected device, enabling arbitrary code execution with access to all stored data, the ability to modify device configuration and relay outputs, and the ability to crash or destabilize the service. A patched-image rebuild at v2.12 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send UDP packets to port 10001 on the target device over the network; no physical or local access is required.

• AuthenticationNot required

  The DVRSearch service accepts messages from any network host without any credentials or session establishment.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user action or interaction on the device side is needed to trigger the overflow.

• Attack complexityDetail

  The exploit is reliable and condition-free: the overflow is triggered deterministically by a single crafted UDP packet with no dependency on timing, memory layout guessing, or environmental state.

Blast Radius

• An attacker gains the ability to execute arbitrary code on the device with the privileges of the DVRSearch service process.
• All data stored on or accessible through the device, including network configuration and credentials, is readable by the attacker.
• The attacker can modify device configuration and directly control the four relay outputs, enabling physical-world manipulation of connected equipment.
• The attacker can crash the DVRSearch service or render the device unresponsive, disrupting Ethernet and RS-485 control availability.