GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### IP field stack overflow The following code is vulnerable to a stack overflow that is attacker-controlled: v3 = strlen(g_network_config->ip_addr); memcpy(&reply_buf[36], g_network_config->ip_addr, v3);
The DVRSearch service reads up to 1460 bytes from an incoming UDP packet into a local buffer, and a pointer to this buffer is stored in a global variable. Subsequently, the code performs a memcpy operation, copying the IP field from network configuration to the stack buffer without length verification — the length is determined dynamically by strlen(). An attacker can craft a UDP packet causing a fully controlled stack buffer overflow, which opens the possibility of overwriting the return address and executing arbitrary code. The service is available to every user on the network without requiring authentication.
An attacker within network range can execute arbitrary code on the device without any authentication, gaining full control over the device's input/output functions and potentially over the entire infrastructure to which the device is connected.
Apply patches available from the manufacturer according to the references (https://www.geovision.com.tw/cyber_security.php). Until updating, it is recommended to isolate the device from untrusted network segments and block access to UDP port 10001 at the firewall or ACL level.
GeoVision GV-I/O Box 4E — versions indicated in manufacturer references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H