CVE-2026-12848

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### DNS field stack overflow The following code is vulnerable to a stack overflow that is attacker-controlled: v8 = strlen(g_network_config->dns_addr); memcpy(&reply_buf[248], g_network_config->dns_addr, v8);

• CWE-121

• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2377
• https://www.geovision.com.tw/cyber_security.php

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1283A Heap-based Buffer Overflow vulnerability affecting the EPR…7.8
• CVE-2026-1284An Out-Of-Bounds Write vulnerability affecting the EPRT file…7.8
• CVE-2026-12844List::SomeUtils::XS versions before 0.59 for Perl have a hea…7.5
• CVE-2026-12845Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-12846GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12847GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12849Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-1285An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…7.5
• CVE-2026-12850Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12851Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12852In Bouncy Castle for Java before 1.85, MLS wire decoder allo…8.7
• CVE-2026-12856A flaw was found in the vscode-java extension, which provide…8.8