The GV-I/O Box 4E device runs a DVRSearch service that listens for UDP messages on port 10001. When processing these messages, the service reads up to 1460 bytes into a local buffer and stores a pointer to this buffer globally. The vulnerability arises from a stack-based buffer overflow triggered by copying the Net Mask field into a fixed buffer at offset 184 without validating its length. This overflow is attacker-controlled, enabling potential arbitrary code execution. The affected version is exactly 2.09. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation of this vulnerability can lead to remote code execution with full system privileges on the affected device. This compromises confidentiality, integrity, and availability of the device and potentially the network it is connected to. Given the device controls physical inputs and relay outputs, exploitation could have safety and operational impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict network access to the DVRSearch service on UDP port 10001 to trusted users only to reduce exposure.