What is the CVSS score of CVE-2026-57267?

CVE-2026-57267 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-57267?

GeoVision's GeoWebPlayer addon in GV-VMS and GV-Cloud systems contains an out-of-bounds array access vulnerability (CVSS 8.3) allowing attackers to trigger information disclosure and potential memory…

How to fix or mitigate CVE-2026-57267?

24 hours: Inventory all systems running GV-VMS or GV-Cloud with GeoWebPlayer enabled; document versions and restrict access from untrusted networks if possible. 7 days: Enable detailed security logging on GeoWebPlayer WebSocket servers; conduct user awareness training on avoiding malicious links; implement email filtering for phishing content. 30 days: Monitor GeoVision's advisory channels and apply a patch immediately upon release; evaluate alternative video management solutions unaffected by this vulnerability.

GeoVision GeoWebPlayer CVE-2026-57267

EUVD-2026-41229 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-pc36-946p-693j

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Localhost-only server reachable only by pivoting through the victim's browser gives AV:N with UI:R; reliable OOB exploitation gives AC:H; the socket needs no auth so PR:N; player-process compromise crosses scope (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:49 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

snapshot command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related software) lets an attacker abuse the local WebSocket server's snapshot command by supplying an unchecked 'index' value that indexes arrays beyond their bounds. Because the CVSS vector is AV:N/UI:R with a scope change, a victim who visits a malicious web page can have their browser drive the localhost WebSocket into out-of-bounds reads/writes, yielding information disclosure and potential memory corruption (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

GeoWebPlayer runs a local WebSocket server that extends the browser-based interfaces of GeoVision surveillance/VMS products, listening for commands from localhost. Several commands, including 'snapshot', accept a client-supplied 'index' integer that is used directly to dereference internal arrays - to enter critical sections, dispatch function calls, or read/write buffers - without validating that the value falls within the array's valid range. The root cause is CWE-129 (Improper Validation of Array Index): the missing bounds check turns an attacker-controlled index into an out-of-bounds memory access. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, with no specific version boundary published, implying all shipping versions of the addon are potentially affected.

RemediationAI

No specific vendor-released fix version is present in the provided data - Patch available per vendor advisory should be confirmed directly against GeoVision's security page at https://www.geovision.com.tw/cyber_security.php and the Talos report TALOS-2026-2373 (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373); apply the updated GeoWebPlayer/Web Plugin build once published. Because exploitation requires the victim's browser to reach the local WebSocket, an effective compensating control is uninstalling or disabling the GeoWebPlayer/Web Plugin addon on hosts that do not require the enhanced web-interface features, with the trade-off that some GeoVision web UI capabilities may stop functioning. On VMS management workstations, restrict operators from general-purpose web browsing so they cannot visit untrusted pages while the player is running. Where the host firewall or WebSocket configuration allows, bind the listener strictly to loopback and block cross-origin connection attempts, accepting that this may break legitimate browser integration if the UI relies on the same channel. Treat management endpoints as sensitive hosts and segregate them from routine internet use.