CVE-2026-12847: GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command

Synopsis

A stack-based buffer overflow affects the GeoVision GV-I/O Box 4E embedded device, specifically in the DVRSearch service that listens on UDP port 10001. The vulnerability is reachable over the network with no authentication required, as any host on the network can send crafted UDP packets to the service. Successful exploitation gives an attacker full remote code execution, with complete read, write, and availability impact on the device. A patched-image rebuild at v2.12 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach UDP port 10001 on the device over the network; DVRSearch listens by default and accepts packets from any network host.

• AuthenticationNot required

  No credentials or session token are needed; DVRSearch processes UDP messages from any sender without authentication.

• Victim interactionNot required

  The vulnerable service processes incoming packets autonomously; no user on the device needs to take any action to trigger the overflow.

• Attack complexityDetail

  Exploitation is reliable and condition-free: sending a single crafted UDP packet is sufficient to trigger the stack overflow with no race condition or memory-layout dependency required.

Blast Radius

• An attacker reads arbitrary memory from the device, including stored network credentials and configuration secrets.
• An attacker writes arbitrary data to the stack and gains control of the instruction pointer, enabling arbitrary code execution on the device.
• An attacker fully controls the device's 4 relay outputs and 4 inputs, allowing physical-world manipulation of whatever hardware is connected.
• An attacker crashes or locks the DVRSearch service or the entire device, disrupting network-based monitoring and control functions.