CVE Intelligence
Analysis AI-assisted

CVE-2026-12847: GV-I/O Box 4E DVRSearch Stack Buffer Overflow

A stack-based buffer overflow in the DVRSearch service of the GV-I/O Box 4E, reachable over UDP port 10001, is rated CVSS 3.1 base score 10.0 in the record. The service runs by default and any user on the network can send it messages. The record lists no affected or fixed versions, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12847 affects the GV-I/O Box 4E, an embedded device with 4 inputs and 4 relay outputs that can be managed over Ethernet and RS-485. According to the record, the DVRSearch service runs by default and listens for UDP messages on port 10001, and a stack-based buffer overflow (CWE-121) exists in how the gateway field is handled. A GeoVision page is listed among the references: GeoVision cyber security page.

Impact

The record assigns a CVSS 3.1 base score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This indicates a network attack vector, no privileges or user interaction required, a changed scope, and high impact to confidentiality, integrity and availability. A stack overflow can crash a service and may in some cases allow code execution; that last point is our inference and is not stated by the sources.

Affected products and versions

  • Product named in the record: GV-I/O Box 4E.
  • Affected firmware or software versions: not listed in the record.
  • Fixed versions: not listed in the record. This does not mean that no fix exists.

The Talos vulnerability report TALOS-2026-2377 is also referenced and should be checked for version details.

Exploitation status

The record shows no CISA KEV listing for this CVE. No confirmed exploitation in the wild appears in the sources consulted. Exploitation status should be rechecked as sources are updated.

Remediation and mitigation

  • Check the vendor page and the Talos report for firmware updates applicable to your device model and revision.
  • Until a fix is verified, restrict network access to the device, especially to the UDP port used by DVRSearch, using network segmentation and firewall rules.
  • Do not expose the device directly to the internet; manage it from isolated control networks.
  • Inventory all GV-I/O Box 4E units, including those reached indirectly through RS-485 gateways or bridges.

Detection guidance

  • Monitor for UDP traffic to the DVRSearch port originating from hosts that are not authorized management systems.
  • Review network logs for unusual volume or malformed messages directed at the device.
  • Watch for unexpected device restarts or abnormal relay output behavior as possible signs of disruption.

Limitations of the available information

The record does not list affected or fixed versions, provides no vendor patch details, has no EPSS score, and carries the source status Deferred. It does not state whether authentication is involved in the vulnerable path. Scores and classifications may change as sources are updated.

Frequently asked questions

Is CVE-2026-12847 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. Status should be rechecked as sources are updated.

Which versions of the GV-I/O Box 4E are affected?

The record does not list affected or fixed versions. Check the vendor page and the Talos report referenced in the advisory for version details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.