What is the CVSS score of CVE-2026-57273?

CVE-2026-57273 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57273?

GeoVision's web-based video surveillance plugin is vulnerable to remote code execution, allowing attackers to take control of surveillance systems by directing users to malicious websites.

How to fix or mitigate CVE-2026-57273?

Within 24 hours: Inventory all systems running GeoVision with the GeoWebPlayer (WS Player) addon and disable the plugin if not operationally essential; establish browser access policies for staff to limit visits to untrusted websites. Within 7 days: Deploy firewall and network rules to restrict local WebSocket connections on affected systems, implement web content filtering to block delivery of malicious pages, and document all business-critical uses of the web player. Within 30 days: Configure real-time monitoring and alerting for suspicious WebSocket or process behavior on VMS systems, evaluate alternative video management solutions or upgrade paths, and establish deployment procedures for vendor patch when released.

GeoWebPlayer CVE-2026-57273

EUVD-2026-41235 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-qq94-fr6f-gvjv

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Browser-mediated reach gives AV:N and UI:R; unauthenticated WebSocket is PR:N; overflow reliability plus cross-origin constraints justify AC:H; crossing browser-to-local-service authority is S:C with full memory-corruption C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:53 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in username field (no key present)

AnalysisAI

Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) is possible because the addon's localhost WebSocket server processes a 'connectionInfo' command whose handler copies attacker-supplied JSON strings into fixed-size buffers without bounds checks (CWE-120). Because the WebSocket is reachable via the victim's browser (AV:N), a malicious web page can drive the overflow when a user with the addon installed visits it (UI:R), yielding memory corruption with high confidentiality, integrity and availability impact and a scope change. No public exploit identified at time of analysis, though Cisco Talos has published a detailed report (TALOS-2026-2375); no EPSS or CISA KEV data was provided.

Technical ContextAI

GeoWebPlayer is a companion addon installed alongside GeoVision video-management products (GV-VMS, GV-Cloud) that stands up a local WebSocket server so browser-based web interfaces can perform functions the browser alone cannot. The server exposes command handlers to clients on the local machine; the 'connectionInfo' command is meant to pass the parameters needed to connect to a camera. The affected code, handle_connect_info (referred to as handle_connection_info), copies fields such as the username out of the received JSON into fixed-size destination buffers using hand-written byte-by-byte copy loops that never enforce the destination length - a textbook classic buffer overflow (CWE-120, unbounded buffer copy). The specific instance flagged is the username field when no key is present. The only affected product identified by CPE is cpe:2.3:a:geovision_inc.:geowebplayer, i.e. the GeoWebPlayer addon itself rather than the core VMS.

RemediationAI

Consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php and upgrade GeoWebPlayer to the vendor-fixed build once identified - patch available per vendor advisory, but no exact fix version is confirmed in the available data, so verify the fixed version directly with GeoVision before relying on it. Cross-reference the technical details in the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375. Because the exploit path is a browser reaching the local WebSocket, effective compensating controls until patching are: uninstall or disable the GeoWebPlayer addon on machines where the web interface is not required (trade-off: browser-based VMS features that depend on it will stop working); restrict outbound browsing on operator/console workstations that run the addon so users cannot reach untrusted pages that could drive the WebSocket (trade-off: reduces general web usability on those hosts); and use host firewall or endpoint rules to limit which processes/origins can open connections to the addon's local WebSocket port (trade-off: requires identifying the exact port and can break legitimate local web clients if scoped too broadly).