Critical Stack Overflow in GV-I/O Box 4E Enables Unauthenticated Remote Code Execution

Overview

CVE-2026-12847 exposes industrial networks to remote code execution (RCE) via a stack overflow in the DVRSearch service. With a CVSS score of 10.0, attackers can trigger RCE by sending malicious UDP packets to port 10001 without authentication, risking operational disruption and data compromise.

Technical Analysis

The vulnerability arises from improper bounds checking during gateway field handling in the DVRSearch service. The service reads up to 1460 bytes into a stack-allocated buffer, which is later manipulated in memory using memcpy without length validation. Attackers can exploit this by crafting UDP packets with oversized gateway payloads, overwriting stack memory and injecting executable code. The lack of authentication, combined with default-enabled service exposure, makes exploitation highly feasible.

Enterprise & DIB Impact

Defense industrial base (DIB) and enterprise environments using GV-I/O Box 4E devices in process control or infrastructure systems face severe risk. Compromised devices could disrupt critical operations, enable lateral movement, or exfiltrate sensitive data. Network segmentation is often limited in industrial networks, amplifying potential damage from unauthenticated access.

Recommended Actions

• Apply vendor-provided firmware patches immediately
• restrict UDP traffic to port 10001 at perimeter firewalls
• implement network segmentation for IoT/embedded devices
• deploy IDS/IPS signatures to detect anomalous UDP packets on port 10001
• and enforce strict input validation for all device management interfaces.