What is the CVSS score of CVE-2026-57272?

CVE-2026-57272 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-57272?

GeoVision's GeoWebPlayer add-on for GV-VMS and GV-Cloud contains a memory corruption vulnerability (CVSS 8.3) exploitable through malicious web pages.

How to fix or mitigate CVE-2026-57272?

24 hours: Inventory all GeoVision deployments using GeoWebPlayer/Web Plugin; assess network exposure and user access patterns. 7 days: Implement network segmentation to restrict WebSocket communication from untrusted sources; if feasible, disable the add-on for non-critical systems pending patch availability. 30 days: Establish monitoring for GeoVision security advisories; develop contingency plan including alternative access methods or version migration if compensating controls prove insufficient.

GeoVision GeoWebPlayer CVE-2026-57272

EUVD-2026-41234 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-6hp2-v2g6-wg25

Authentication Bypass Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

A malicious page reaches the local WebSocket via the victim's browser, so AV:N with UI:R and no auth (PR:N); the unchecked-index primitive is non-trivial to weaponize (AC:H) and memory corruption crossing the browser/host boundary yields S:C with C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:51 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

byPass command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer add-on (also branded 'Web Plugin' for GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker abuse the 'byPass' WebSocket command by supplying an unchecked 'index' value, corrupting memory to achieve high-impact compromise (CVSS 8.3). The bundled component runs a local WebSocket server for GeoVision web interfaces (GV-VMS, GV-Cloud); because the server is reachable from a victim's browser, a malicious web page can drive the flaw with only user interaction and no authentication. No public exploit identified at time of analysis, though a Talos vulnerability report (TALOS-2026-2373) documents the issue.

Technical ContextAI

GeoWebPlayer is an installable add-on shipped with GeoVision video-management and cloud products (GV-VMS, GV-Cloud) that stands up a local WebSocket server to extend the vendor's browser-based interfaces. The server dispatches numerous commands, many of which accept an integer 'index' used to index internal arrays that gate critical sections, function-pointer dispatch, and other actions. The root cause is CWE-129 (Improper Validation of Array Index): the 'byPass' command handler uses the caller-supplied index without bounds checking, allowing reads/writes past array limits. The affected component is identified as cpe:2.3:a:geovision_inc.:geowebplayer:*, i.e. all versions of the GeoWebPlayer add-on regardless of the host GeoVision product it was installed alongside.

RemediationAI

No vendor-released patch version is identified in the available data; consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php and the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373) for a fixed release and apply it once published. As compensating controls until a patched build is deployed: uninstall or disable the GeoWebPlayer/Web Plugin/WS Player add-on on hosts that do not require the browser-integration features (trade-off: GeoVision web interfaces relying on it may lose functionality); ensure the local WebSocket port is firewalled to the loopback interface only and block untrusted outbound web browsing on machines running the GeoVision software to reduce the malicious-page vector (trade-off: tighter egress control on operator workstations); and restrict which browsers/users can reach the GeoVision console host. Because the attack rides a victim-initiated browser session, operator security-awareness (avoiding untrusted pages while the plugin is active) is a meaningful stopgap.