CVE-2026-12847 Overview
CVE-2026-12847 is a stack-based buffer overflow [CWE-121] in the DVRSearch service of the GeoVision GV-I/O Box 4E. The device is a smart embedded controller with four inputs and four relay outputs, manageable over Ethernet and RS-485. The DVRSearch service listens by default on UDP port 10001 and accepts unauthenticated messages from any host on the network. An attacker can send a crafted UDP packet that triggers an attacker-controlled stack overflow when the service copies the configured gateway field into a fixed-size reply buffer. The flaw carries a CVSS 3.1 score of 10.0 with a scope change, enabling remote code execution on the embedded device without credentials or user interaction.
Critical Impact
Unauthenticated remote attackers on the same network can corrupt the service stack via a single UDP packet to port 10001, leading to arbitrary code execution on the GV-I/O Box 4E.
Affected Products
- GeoVision GV-I/O Box 4E embedded controller
- DVRSearch service component (UDP/10001)
- Devices using the affected firmware exposing the network configuration handler
Discovery Timeline
- 2026-06-24 - CVE-2026-12847 published to the National Vulnerability Database (NVD)
- 2026-06-25 - Last updated in the NVD database
Technical Details for CVE-2026-12847
Vulnerability Analysis
The DVRSearch service binds to UDP port 10001 and processes inbound messages without authentication. When the service receives a UDP datagram, it reads up to 1460 bytes into a local buffer and stores a pointer to that buffer in a global variable for later use by request handlers.
During reply construction, the handler copies the gateway string from the global network configuration structure into a fixed offset within the reply buffer on the stack. The copy uses strlen() to size the operation and memcpy() to perform the write, with no bounds check against the destination buffer length. Because the gateway field originates from configuration state that an attacker can influence through prior protocol interactions, the overflow length and content are attacker-controlled.
The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow. Successful exploitation can overwrite saved return addresses or adjacent stack data, redirecting execution flow on the embedded controller.
Root Cause
The root cause is the use of memcpy(&reply_buf[216], g_network_config->gateway, strlen(g_network_config->gateway)) without validating that the source length fits the remaining space in reply_buf. The handler trusts the size returned by strlen() on attacker-influenced configuration data.
Attack Vector
The attack vector is the network. An attacker sends a UDP message to port 10001 on a reachable GV-I/O Box 4E. No authentication, privileges, or user interaction are required. The scope change reflected in the CVSS vector indicates that successful exploitation impacts components beyond the vulnerable service.
No verified proof-of-concept code is published in the enriched dataset. Refer to the Talos Intelligence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-12847
Indicators of Compromise
- Unexpected UDP traffic to port 10001 on GV-I/O Box 4E devices from non-administrative hosts
- GV-I/O Box 4E devices rebooting, hanging, or losing relay state without operator action
- Outbound connections initiated by IoT controllers to unfamiliar internet hosts following inbound UDP/10001 traffic
Detection Strategies
- Inspect network flow records for UDP/10001 sessions originating outside trusted management subnets
- Deploy IDS signatures that flag oversized or malformed DVRSearch discovery payloads to GeoVision devices
- Correlate device availability alerts with preceding UDP/10001 packets to identify exploitation attempts
Monitoring Recommendations
- Log all UDP/10001 traffic at network choke points between operational technology (OT) and information technology (IT) zones
- Track configuration changes to the gateway field on GV-I/O Box 4E units through syslog or SNMP polling
- Alert on repeated discovery requests from a single source within short time windows
How to Mitigate CVE-2026-12847
Immediate Actions Required
- Block UDP port 10001 at network boundaries and restrict it to dedicated management hosts using stateful firewall rules
- Segment GV-I/O Box 4E devices onto isolated VLANs that deny direct access from user and guest networks
- Inventory exposed devices and disable DVRSearch discovery where the service is not operationally required
Patch Information
No patch reference is listed in the enriched CVE data at publication. Consult GeoVision Cybersecurity Resources for firmware updates and the Talos Intelligence Vulnerability Report for advisory coordination details.
Workarounds
- Enforce ingress access control lists permitting UDP/10001 only from authorized management workstations
- Place GV-I/O Box 4E devices behind a layer 3 device that drops broadcast and unicast discovery probes from untrusted ranges
- Disconnect units from production networks if firmware updates are not yet available and operational risk allows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
