CVE Intelligence
Analysis AI-assisted

CVE-2026-12846: GeoVision GV-I/O Box 4E: stack buffer overflow in DVRSearch service

CVE-2026-12846 affects the GV-I/O Box 4E, where the DVRSearch service listening on UDP port 10001 can overflow a stack buffer through the Net Mask field. The CNA scores it 10.0 under CVSS 3.1 with a network attack vector and no privileges required. The record lists no affected or fixed versions and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

GV-I/O Box 4E is an embedded device with four inputs and four relay outputs, controllable over Ethernet and RS-485. According to the record, the DVRSearch service runs by default and listens for UDP messages on port 10001. The CNA describes a stack-based buffer overflow in how the Net Mask field is copied into a reply buffer.

Impact

  • The CNA assigns a CVSS 3.1 base score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network reachability, low complexity, no privileges and no user interaction.
  • The weakness is classified as CWE-121, Stack-based Buffer Overflow.
  • The vector reports high impact on confidentiality, integrity and availability. The specific consequences for a given deployment are not described in the sources.

Affected products and versions

  • The record identifies the product as GV-I/O Box 4E.
  • The record lists no affected version ranges and no fixed versions. This does not mean no fix exists; check the vendor advisory.
  • The attribution to GeoVision is an inference from the vendor page listed in the record: GeoVision security page.

Exploitation status

  • The record shows the CISA KEV listing as false, so no active exploitation is claimed here.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Check the vendor security page for firmware or patch status for GV-I/O Box 4E devices.
  • Restrict access to UDP port 10001 to trusted management hosts using network segmentation and firewall rules.
  • Avoid exposing these devices directly to untrusted networks or the internet.
  • Inventory deployed devices and confirm whether the DVRSearch service is running and reachable.

Detection guidance

  • Review network logs for UDP traffic to port 10001 originating from hosts outside the expected management systems.
  • Treat unexpected traffic to this service as a security event and investigate the source.

Limitations of the available information

  • The record does not provide affected firmware versions, fixed versions or vendor-confirmed exploitation details.
  • The Talos report (TALOS-2026-2377) and the GeoVision page are listed as references, but their contents were not reviewed for this analysis.
  • No EPSS or SSVC data is available in the record.

Frequently asked questions

What is the core weakness in CVE-2026-12846?

The CNA describes a stack-based buffer overflow (CWE-121) in the DVRSearch service, where the Net Mask field is copied into a reply buffer without a bounds check that matches the source length.

Which port and service are involved?

The record says the DVRSearch service listens for UDP messages on port 10001 on the GV-I/O Box 4E and is running by default.

Is this vulnerability known to be actively exploited?

No. The record shows the vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.