External risk intelligence

GV-I/O Box 4E DVRSearch Net Mask Stack Overflow.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-12846

The device is an embedded I/O controller intended for local network management via Ethernet. While the service listens on a UDP port, these devices are typically deployed within private industrial or local area networks and are not designed to be directly exposed to the public internet, though accidental exposure through misconfiguration is possible.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the GV-I/O Box 4E, a smart embedded device, which could allow unauthorized individuals to impact its operation. This issue resides within a service that listens for network messages, and while the device is typically used in local networks, confirming its specific exposure is the primary concern.

Network messages can cause the device to malfunction.
Remember this for industrial control system awareness.
Confirm if this device is in your network.

Attack Path

How an attacker could exploit the issue

An attacker on the same network can send specially crafted UDP messages to the GV-I/O Box 4E's DVRSearch service. This service processes these messages by copying data into a buffer, but it does not properly check the size of the input. If the input is too large, it can overwrite adjacent memory on the stack, potentially allowing an attacker to gain control of the device.

Network access required.
Send oversized UDP message.
Stack overflow leads to control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the network configuration data and potentially service availability on the GV-I/O Box 4E when it processes specific UDP messages on port 10001. A stack overflow in the DVRSearch service could lead to altered network settings or service disruption.

Network configuration data.
Unauthenticated network messages.
Service disruption and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely falls to infrastructure or platform teams responsible for managing embedded devices and network services. The first practical step is to identify all instances of the affected GV-I/O Box 4E devices, confirm their network reachability, and assess their business criticality. Once these devices are located and prioritized, the accountable owner should be identified to plan appropriate remediation.

Infrastructure or platform teams own the issue.
Verify device network reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GV-I/O Box 4E?

The GV-I/O Box 4E is an embedded hardware controller that manages physical inputs and relay outputs. It is commonly used in automation environments to bridge digital signals with network-based management over Ethernet or RS-485 connections. The device includes a service called DVRSearch that enables network-based configuration and communication.

What does the stack overflow in CVE-2026-12846 mean?

This vulnerability is classified as CWE-121, or Stack-based Buffer Overflow. It occurs when a program writes more data to a memory buffer than it is designed to hold, spilling over into adjacent memory. In this case, the device incorrectly processes network input, which can corrupt the system's memory and potentially allow an attacker to hijack the device's execution.

How can an attacker trigger this vulnerability?

An attacker can trigger the issue by sending a specially crafted UDP packet to port 10001 on the device. Because the DVRSearch service does not validate the size of the incoming data before copying it to a memory buffer, an oversized input causes the crash. Simply sending standard, correctly formatted network traffic or accessing unrelated services does not trigger the overflow.

Is my GV-I/O Box 4E at risk?

Halo Surface Signal indicates that while these devices are usually found in private industrial or local networks, they are at risk if they are accessible to unauthorized users on the same network. Because the service listens for UDP traffic, any misconfiguration that exposes the device to untrusted network segments significantly increases the likelihood of unauthorized interaction.

What are the first steps to address this issue?

Your priority is to inventory your environment to locate all GV-I/O Box 4E units. Once identified, verify their network placement to confirm they are not reachable from untrusted zones. Coordinate with the teams responsible for these devices to assess their operational criticality and prepare for necessary updates or configuration changes to restrict network access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.