What is the CVSS score of CVE-2026-57269?

CVE-2026-57269 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Geowebplayer are affected by CVE-2026-57269?

GeoVision's GeoWebPlayer plugin, embedded in GV-VMS and GV-Cloud surveillance systems, contains a critical vulnerability (CVSS 8.3) that allows remote attackers to access sensitive surveillance data,…

How to fix or mitigate CVE-2026-57269?

Within 24 hours: Identify and catalog all installations of GeoVision GV-VMS and GV-Cloud systems; implement firewall rules to restrict access to surveillance admin interfaces from external networks and untrusted sources. Within 7 days: Disable the bundled WebSocket helper service if operationally feasible; if required for operations, apply browser security policies (Content Security Policy) to prevent cross-origin command injection and require VPN-only access for all remote administration. Within 30 days: Escalate to GeoVision for patch availability and timeline; if remediation is not forthcoming, evaluate alternative surveillance solutions to reduce organizational risk.

Geowebplayer CVE-2026-57269

EUVD-2026-41231 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-g6qv-499j-qp84

Information Disclosure Geowebplayer

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (GV) · only source for this CVE.

CVSS VectorVendor: GV

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:50 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

disconnect command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read memory, corrupt state, or crash the local WebSocket helper bundled with GV-VMS, GV-Cloud, and related surveillance software. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify and catalog all installations of GeoVision GV-VMS and GV-Cloud systems; implement firewall rules to restrict access to surveillance admin interfaces from external networks and untrusted sources. …

Threat intelligence, references, and detailed analysis are available after sign-in.