The GV-I/O Box 4E device runs a DVRSearch service that accepts UDP messages on port 10001. The service reads up to 1460 bytes into a local buffer and stores a pointer to it globally. A stack-based buffer overflow occurs when the gateway field from the network configuration is copied into a fixed offset in the reply buffer without validating its length. This vulnerability (CWE-121) allows an unauthenticated network attacker to execute arbitrary code or cause denial of service. The affected version is 2.09. No official patch or remediation has been disclosed yet.

Successful exploitation of this vulnerability can lead to remote code execution, complete system compromise, and denial of service on the GV-I/O Box 4E device. The CVSS 3.1 base score is 10.0 (critical), reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device, especially blocking UDP port 10001 from untrusted sources, to reduce exposure.