The GV-I/O Box 4E runs a DVRSearch service that listens on UDP port 10001 and reads up to 1460 bytes into a local buffer. The vulnerability arises when the DNS address string length is used to copy data into a fixed offset in a reply buffer without validating the length, resulting in a stack-based buffer overflow (CWE-121). This overflow is attacker-controlled via network UDP messages, allowing remote unauthenticated attackers to execute arbitrary code or cause denial of service. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected version is exactly 2.09. No official patch or remediation is currently documented.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code with the privileges of the DVRSearch service or cause a denial of service by crashing the device. This compromises the confidentiality, integrity, and availability of the GV-I/O Box 4E device, potentially impacting any systems or processes relying on it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to UDP port 10001 on the GV-I/O Box 4E to trusted sources only to reduce exposure. Monitor for unusual network activity targeting this port. Do not expose the device to untrusted networks.