CVE-2026-12848— GeoVision GV-I/O Box 4E 缓冲区错误漏洞

GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### DNS field stack overflow The following code is vulnerable to a stack overflow that is attacker-controlled: v8 = strlen(g_network_config->dns_addr); memcpy(&reply_buf[248], g_network_config->dns_addr, v8);

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

栈缓冲区溢出

GeoVision GV-I/O Box 4E 缓冲区错误漏洞

GeoVision GV-I/O Box 4E是日本GeoVision公司的一款用于安全监控系统的网络输入输出扩展控制模块。 GV-I/O Box 4E V2.09版本存在缓冲区错误漏洞，该漏洞源于DNS字段处理存在栈缓冲区溢出，可能导致攻击者控制崩溃。

N/A

N/A