External risk intelligence

GV-I/O Box 4E DVRSearch UDP IP Field Stack Overflow

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-12485

The device is a smart embedded I/O controller intended for remote monitoring and control over Ethernet. While intended for local network management, such industrial and infrastructure-adjacent devices are frequently exposed to the public internet in common deployment scenarios to facilitate remote access, management, or integration with external monitoring systems.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in the GV-I/O Box 4E, a smart embedded device used for industrial control and monitoring. The issue resides within the DVRSearch service, which is enabled by default and handles network communication. An attacker could exploit this flaw to gain significant control over the affected device, potentially impacting operations that rely on its input and output functions. The primary concern is to confirm if this type of device is in use within the organization and assess any potential exposure.

Flaw allows unauthorized control of devices.
Critical vulnerability impacts industrial control systems.
Confirm usage and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker on the same network can send specially crafted UDP messages to a service running on the GV-I/O Box 4E. This service processes the incoming message, and a flaw in how it handles the IP address field can lead to a stack overflow. This vulnerability can result in significant information disclosure, integrity compromise, and denial of service.

Requires network access.
Vulnerable service triggered by UDP message.
High impact on confidentiality, integrity, availability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to crash the DVRSearch service and potentially take control of the GV-I/O Box 4E, impacting its ability to manage inputs and outputs. This could occur when an attacker sends specially crafted UDP messages to the device.

Service availability and device control.
Malicious UDP messages sent over the network.
Denial of service or unauthorized control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding ownership and the initial steps for addressing this vulnerability requires collaboration between teams managing industrial control systems or embedded devices and network security teams. The first practical action is to locate all instances of the GV-I/O Box 4E within your environment, assess their network exposure, determine their criticality to business operations, and identify the accountable owner for each device to prioritize remediation efforts.

Device owners must lead remediation efforts.
Verify device network exposure and business criticality.
Plan maintenance for risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GV-I/O Box 4E?

The GV-I/O Box 4E is an embedded hardware controller used for industrial monitoring and automation. It features four inputs and four relay outputs, allowing it to manage external physical equipment or sensors. It communicates over Ethernet and RS-485 networks, acting as a bridge between digital commands and physical processes, such as triggering alarms or monitoring facility hardware.

What does CVE-2026-12485 mean for the device?

This vulnerability is a stack-based buffer overflow, classified as CWE-121. It occurs because the device's DVRSearch service improperly calculates buffer space when processing the IP address field in incoming network messages. By sending a carefully crafted packet, an attacker can overwrite memory, which may crash the service or allow them to gain unauthorized control over the device's operations.

How is this vulnerability triggered?

The flaw is triggered when the DVRSearch service receives a specific UDP message on port 10001. Because this service is enabled by default, the device is susceptible immediately upon network connection. Importantly, the vulnerability is not triggered by standard, legitimate management traffic; it requires a specially crafted message designed to exploit the buffer overflow condition during the handling of network configuration data.

Is my GV-I/O Box 4E at risk?

According to Halo Surface Signal, risk is high if your device is accessible via the internet, which is a common deployment scenario for remote monitoring. While these controllers are typically meant for local management, they are frequently connected to wider networks. If your device is reachable from outside your local network, the potential for unauthorized access increases significantly, necessitating immediate review.

What should I do to address this issue?

First, conduct an inventory to locate all GV-I/O Box 4E units in your network. Coordinate with the operational teams responsible for these devices to verify their current network exposure. Prioritize restricting access to these devices by placing them behind firewalls or VPNs to isolate them from untrusted networks while you work with the manufacturer to identify and implement the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.