CVE-2026-12846 Overview
CVE-2026-12846 is a stack-based buffer overflow [CWE-121] affecting the GeoVision GV-I/O Box 4E, an embedded device with four inputs and four relay outputs controllable over Ethernet and RS-485. The flaw resides in the DVRSearch service, which listens for UDP messages on port 10001 by default. Any unauthenticated attacker on the network can send a crafted UDP packet that triggers memory corruption when the service copies the net_mask field into a fixed-size stack buffer using memcpy without bounds validation. The vulnerability carries a CVSS 3.1 base score of 10.0 with a scope change, indicating attacker-controlled stack corruption that can lead to arbitrary code execution on the embedded device.
Critical Impact
Unauthenticated remote attackers on the same network can corrupt the stack of the DVRSearch service via a single UDP packet, enabling code execution on the IoT device.
Affected Products
- GeoVision GV-I/O Box 4E embedded controller
- DVRSearch service listening on UDP port 10001
- Devices using the vulnerable network configuration handling routine
Discovery Timeline
- 2026-06-24 - CVE-2026-12846 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-12846
Vulnerability Analysis
The DVRSearch service runs by default on the GV-I/O Box 4E and accepts UDP datagrams on port 10001. The service reads up to 1460 bytes from each incoming packet into a local buffer and stores a pointer to that buffer in a global variable. When constructing its reply, the service references network configuration values, including the net_mask field, and copies them into a stack-resident reply buffer.
The vulnerable routine calculates the length of the attacker-influenced net_mask string with strlen and then performs a memcpy of that length into reply_buf[184]. Because the destination is a fixed-size stack allocation and no bounds check exists, an oversized net_mask overflows adjacent stack memory, overwriting saved return addresses and local variables. Attackers can leverage this primitive to redirect control flow within the firmware.
Root Cause
The root cause is an absence of length validation before the memcpy operation. The code trusts strlen(g_network_config->net_mask) as the copy size without verifying that the source string fits within the destination buffer at offset 184 of reply_buf. Network configuration values reachable through the UDP protocol handler can be manipulated to exceed safe lengths.
Attack Vector
Exploitation requires only network reachability to UDP port 10001 on the target device. No authentication, user interaction, or prior foothold is needed. An attacker sends a crafted UDP message that influences the net_mask field referenced during reply construction, triggering the stack overflow. Because the service runs with device privileges and the CVSS scope is changed, successful exploitation can affect components beyond the vulnerable process.
No verified exploit code is publicly available. See the Talos Intelligence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-12846
Indicators of Compromise
- Unexpected UDP traffic destined for port 10001 on GV-I/O Box 4E devices from non-administrative hosts
- Oversized UDP datagrams approaching the 1460-byte read limit targeting the DVRSearch service
- Unscheduled reboots, crashes, or watchdog resets on GV-I/O Box 4E devices
- Outbound connections initiated by IoT devices to unfamiliar external hosts following inbound UDP/10001 traffic
Detection Strategies
- Deploy network IDS signatures that flag UDP packets to port 10001 containing abnormally long string fields
- Baseline normal DVRSearch discovery traffic and alert on deviations in packet size or source
- Inspect firewall and switch logs for unsolicited UDP/10001 traffic from untrusted VLANs
Monitoring Recommendations
- Forward IoT VLAN flow records to a centralized log platform and correlate against device inventory
- Monitor device availability and syslog output from GeoVision devices for crash indicators
- Alert on any host scanning for UDP/10001 across the IoT segment
How to Mitigate CVE-2026-12846
Immediate Actions Required
- Restrict UDP/10001 access to GV-I/O Box 4E devices using ACLs or firewall rules so only authorized management hosts can reach the service
- Place GeoVision devices on an isolated VLAN that is not routable from user or guest networks
- Inventory all GV-I/O Box 4E units and confirm exposure of the DVRSearch service
Patch Information
No vendor patch reference is listed in the NVD record at publication. Monitor the GeoVision Cyber Security Resource for firmware updates addressing CVE-2026-12846 and apply them once available.
Workarounds
- Block inbound UDP/10001 at network boundaries and between trust zones until a firmware fix is applied
- Disable the DVRSearch discovery feature where supported by configuration
- Use static IP assignments and management workflows that do not depend on UDP discovery
# Example firewall rule to restrict DVRSearch exposure
iptables -A INPUT -p udp --dport 10001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 10001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
