What is the CVSS score of CVE-2026-57271?

CVE-2026-57271 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoWebPlayer are affected by CVE-2026-57271?

GeoVision's GeoWebPlayer addon (used in GV-VMS and GV-Cloud video surveillance systems) contains a HIGH-severity out-of-bounds indexing vulnerability in its WebSocket service that allows remote…

How to fix or mitigate CVE-2026-57271?

Within 24 hours: Inventory all GeoVision GV-VMS, GV-Cloud, and GeoWebPlayer installations and restrict WebSocket access via firewall to administrative networks only. Within 7 days: Enable detailed WebSocket connection logging, implement rate limiting, segment affected systems from general networks, and configure alerting for service crashes or malformed connection attempts. Within 30 days: Contact GeoVision for patch status and timeline; evaluate operationally feasible disablement of remote WebSocket access or request vendor-specific IDS/WAF rules for malformed 'pause' command detection.

GeoWebPlayer CVE-2026-57271

EUVD-2026-41233 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-ggj6-4g5f-g778

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

6.9 MEDIUM

Network-reachable but gated by AC:H and UI:R with no auth (PR:N); the 'Information Disclosure' tag plus an OOB-index read supports C:H and a possible crash (A:L), with no evidence of an integrity write (I:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:51 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

pause command index-out-of-bound

AnalysisAI

Out-of-bounds array indexing in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) allows a remote attacker to leak memory or crash the local WebSocket service by delivering a malformed 'pause' command. The addon runs a WebSocket server that backs the browser interfaces of GeoVision products such as GV-VMS and GV-Cloud, so any browser tricked into connecting to it can trigger the flaw. No public exploit identified at time of analysis; the issue was reported by the vendor (GeoVision) and documented by Cisco Talos (TALOS-2026-2373).

Technical ContextAI

GeoWebPlayer is a companion component installed alongside GeoVision surveillance/VMS software; it stands up a local WebSocket server that extends the browser-based web interfaces those products rely on. The vulnerability is classified as CWE-129 (Improper Validation of Array Index): the handler for the WebSocket 'pause' command uses an attacker-influenced value to index into an array without confirming the index falls within bounds. Depending on how the out-of-range access is used, this reads (or potentially writes) memory outside the intended buffer, producing information disclosure and/or a service crash. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, whose version wildcard implies all builds are implicated until a fixed release is confirmed.

RemediationAI

Patch available per vendor advisory - consult the GeoVision cyber security page (https://www.geovision.com.tw/cyber_security.php) and TALOS-2026-2373 (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373) for the fixed GeoWebPlayer build, as no exact fixed version is present in the provided data. Because exploitation requires a browser to reach the local WebSocket server, effective compensating controls until patched include uninstalling or stopping the GeoWebPlayer/Web Plugin service on hosts that do not need the web interface (trade-off: the GeoVision web UIs that depend on it lose functionality), and restricting the WebSocket listener to loopback while firewalling its port from other hosts so remote origins cannot initiate connections (trade-off: breaks legitimate remote web-interface access). Operationally, instruct users not to browse untrusted sites on machines running the addon, since the attack hinges on user interaction with attacker-controlled content.