CVE-2026-12848
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-121
Desbordamiendo de búfer basado en pila (Stack)
Fecha de publicación:
24/06/2026
Última modificación:
25/06/2026
Descripción
*** Pendiente de traducción *** GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.<br />
<br />
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. <br />
<br />
<br />
<br />
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:<br />
<br />
<br />
<br />
#### DNS field stack overflow<br />
<br />
The following code is vulnerable to a stack overflow that is attacker-controlled:<br />
<br />
<br />
<br />
v8 = strlen(g_network_config->dns_addr);<br />
<br />
memcpy(&reply_buf[248], g_network_config->dns_addr, v8);
Impacto
Puntuación base 3.x
10.00
Gravedad 3.x
CRÍTICA