CVE-2026-12847

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E (affected versions not specified)

Description The DVRSearch service, which runs by default on UDP port 10001, processes unauthenticated discovery and configuration messages. A stack-based buffer overflow occurs because the server uses strlen() to determine the length of the gateway field and subsequently copies it into a fixed-size reply buffer using memcpy(). An attacker on the same local area network can send a crafted UDP packet with an excessively long gateway field to overflow the stack, potentially leading to remote code execution and full device compromise.

Recommendations As a temporary workaround, disable the DVRSearch service on UDP port 10001 or restrict access to this port using Access Control Lists (ACLs). At the moment, there is no information about a newer version that contains a fix for this vulnerability.