CVE-2026-12848: GV-I/O Box DVRSearch UDP Stack-Based Buffer Overflow
CVE-2026-12848 is a critical stack-based buffer overflow (CWE-121) in the DVRSearch UDP service of the GV-I/O Box, an embedded device with inputs and relay outputs. The CNA assigns a CVSS 3.1 base score of 10.0, and the record indicates that network users can reach the vulnerable service. The record lists no affected or fixed versions and no KEV listing, so exposure assessment and vendor contact are the immediate priorities.
Overview
CVE-2026-12848 affects the GV-I/O Box, an embedded device with four inputs and four relay outputs that can be controlled over Ethernet and RS-485. The DVRSearch service runs by default on the device and listens for UDP messages on port 10001. According to the record, a stack-based buffer overflow (CWE-121) can be triggered through the handling of the DNS field in this service.
The technical details are described in the Talos vulnerability report TALOS-2026-2377 and in the GeoVision cyber security page.
Impact
The CNA assigns a CVSS 3.1 base score of 10.0. The vector indicates a network attack vector, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability. The vector also marks the scope as changed, which means the impact may extend beyond the vulnerable component.
- A compromised device could affect the relay outputs and input status it controls.
- Physical processes connected to the device may be affected if its outputs are used in automation.
Affected products and versions
- The record does not list any affected product versions.
- The record does not list any fixed versions.
- Confirm firmware and model coverage directly with the vendor through the GeoVision cyber security page.
Exploitation status
The CVE is not listed in CISA KEV in the consulted record. No confirmed exploitation in the wild appears in the sources consulted. Public exploit availability is unknown.
Remediation and mitigation
- The record lists no vendor fix. This does not mean no fix exists, so check the vendor page regularly.
- Restrict access to UDP port 10001 to trusted hosts using network segmentation and firewall rules.
- Do not expose the device directly to untrusted networks or the internet.
- If DVRSearch is not required for operations, verify with the vendor whether it can be disabled or blocked.
- Build an inventory of all GV-I/O Box devices in the environment and prioritize those reachable from wide networks.
Detection guidance
- Monitor for UDP traffic to port 10001 originating from unexpected or untrusted sources.
- Alert on unexpected restarts, crashes or loss of responsiveness of the device.
- Review network logs for connections to the device from segments that should not have access.
Limitations of the available information
The record does not include affected or fixed versions, EPSS or SSVC data, or a detailed vendor advisory beyond the description. Its source status is recorded as Deferred. Whether exploit code exists publicly is unknown, and the consulted sources do not confirm active exploitation.
Frequently asked questions
Is CVE-2026-12848 being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The critical CVSS score still justifies prompt exposure review.
Which versions are affected and is a fix available?
The record lists no affected or fixed versions. Contact GeoVision through its cyber security page to confirm coverage and available updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.