The GV-I/O Box 4E device runs a DVRSearch service that listens on UDP port 10001. Upon receiving a UDP message, the service reads up to 1460 bytes into a local buffer and stores a pointer to this buffer globally. The vulnerability arises from unsafe handling of the IP address string (g_network_config->ip_addr) which is copied into a fixed offset in a reply buffer using memcpy without length checks, leading to a stack-based buffer overflow (CWE-121). This overflow is attacker-controlled via the UDP message, allowing remote unauthenticated attackers on the network to potentially execute arbitrary code or cause denial of service. The CVSS v3.1 score is 10.0, reflecting critical impact on confidentiality, integrity, and availability. The affected version is exactly 2.09. No patch or official remediation is currently documented.

Successful exploitation allows remote unauthenticated attackers on the local network to cause a stack-based buffer overflow in the DVRSearch service, potentially leading to arbitrary code execution, full device compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the device. The CVSS score of 10.0 indicates critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's UDP port 10001 to trusted users only to reduce exposure. Monitor for unusual activity related to the DVRSearch service. Avoid exposing the device to untrusted networks.