What is the CVSS score of CVE-2026-57265?

CVE-2026-57265 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoWebPlayer are affected by CVE-2026-57265?

GeoVision's surveillance components in GV-VMS and VMS-Cloud deployments are vulnerable to attacks through employee web browsing, creating an unexpected insider-enablement risk where legitimate…

How to fix or mitigate CVE-2026-57265?

24 hours: Inventory all GeoVision GeoWebPlayer, GV-VMS, and VMS-Cloud installations with current version numbers; identify which employees have internet access from surveillance-connected systems; assess criticality and geographic scope of affected surveillance zones. 7 days: Implement network segmentation isolating surveillance infrastructure from internet-connected systems via air-gaps, VLANs, or proxies; disable WebSocket or restrict cross-origin requests at network boundaries; require affected users to access external networks via secured VPN with deep-packet inspection only. 30 days: Establish daily monitoring of GeoVision security advisories and Cisco Talos TALOS-2026-2373 updates; develop and test emergency patching procedures; if no patch available within 90 days, implement permanent architectural changes or evaluate alternative surveillance vendors.

GeoWebPlayer CVE-2026-57265

EUVD-2026-41227 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-9pfj-whg2-p6r5

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Cross-origin WebSocket reaches localhost via the victim's browser (AV:N, UI:R, AC:H) with no auth (PR:N); out-of-bounds read primarily discloses memory (C:H) with limited integrity/crash impact (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:47 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

audio command index-out-of-bound

AnalysisAI

Memory-disclosure and denial-of-service in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) stems from an unvalidated index parameter in its localhost WebSocket command handler (audio command path), letting an attacker read and act on out-of-bounds array elements. Because the WebSocket listener is reachable cross-origin, a victim who is lured to a malicious web page can have their browser drive the local service, so the effective attack vector is network-based despite the server binding to localhost. No public exploit code is identified at time of analysis, though a Cisco Talos advisory (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV.

Technical ContextAI

GeoWebPlayer is an optional add-on shipped with GeoVision surveillance/VMS products (GV-VMS, GV-Cloud, VMS-Cloud) that runs a local WebSocket server to bridge browser-based management interfaces to native functionality (e.g., audio playback). WebSocket connections are not bound by the same-origin policy in the way XHR/fetch are, so any web page the victim visits can open a socket to the loopback listener and issue commands. The root cause is CWE-129 (Improper Validation of Array Index): numerous commands accept an index that is used to index internal arrays - to enter critical sections, dispatch function calls, and access state - without range checking, permitting out-of-bounds access. The specific instance here is the audio command handler. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:* with no version bounds published.

RemediationAI

No exact fixed version was provided in the input; monitor GeoVision's security page (https://www.geovision.com.tw/cyber_security.php) and the Talos advisory (TALOS-2026-2373) for a patched GeoWebPlayer build and apply it once released. As compensating controls until a patch is confirmed: uninstall or disable the GeoWebPlayer/Web Plugin/WS Player add-on on hosts that do not require the browser-based interfaces (trade-off: certain web-UI features of GV-VMS/GV-Cloud may stop functioning); restrict outbound web browsing on operator workstations that run the add-on to prevent them from reaching attacker-controlled pages that could drive the loopback WebSocket; and, where the local firewall or the plugin's configuration permits, block or filter unexpected connections to the GeoWebPlayer WebSocket port so only trusted local origins can reach it. Because exploitation is browser-mediated, keeping operators off untrusted sites on VMS hosts meaningfully reduces exposure.