What is the CVSS score of CVE-2026-57275?

CVE-2026-57275 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57275?

GeoVision GeoWebPlayer (bundled with GV-VMS, GV-Cloud, and VMS-Cloud) contains a critical buffer overflow vulnerability (CVSS 8.3) that allows attackers to execute code when users visit malicious…

How to fix or mitigate CVE-2026-57275?

Within 24 hours: Inventory all GeoVision video management systems (GV-VMS, GV-Cloud, VMS-Cloud instances) and document current versions and GeoWebPlayer plugin deployment status. Within 7 days: Implement network-level access controls (firewall rules, IP allowlisting, WAF) to restrict browser-based access to GeoVision web consoles; disable WebSocket-based video player and mandate alternative video viewers; conduct staff awareness briefing on visiting untrusted websites during surveillance access. Within 30 days: Monitor GeoVision security advisories and Cisco Talos research (TALOS-2026-2375) for patch releases; establish and test patch deployment procedures; evaluate alternative video management platforms if vendor patch timeline exceeds risk tolerance.

GeoWebPlayer CVE-2026-57275

EUVD-2026-41237 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-7688-vvq2-xxj3

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote malicious page reaches the localhost WebSocket via the browser (AV:N, UI:R), no auth (PR:N), reliable overflow is nontrivial (AC:H), and code exec across the browser-to-plugin boundary yields S:C with full CIA impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:53 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in username field (key present)

AnalysisAI

Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) lets an attacker reach the localhost WebSocket server and overflow fixed-size buffers via the connectionInfo command's username field, achieving memory corruption and likely code execution (CVSS 8.3, CWE-120). Because the server listens on localhost, exploitation is reached through a victim's browser visiting a malicious page (UI:R, AC:H), giving high confidentiality, integrity and availability impact with a scope change. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw was independently documented by Cisco Talos (TALOS-2026-2375).

Technical ContextAI

GeoWebPlayer is a companion addon installed alongside GeoVision surveillance software (GV-VMS, GV-Cloud, VMS-Cloud) that stands up a local WebSocket server so the vendor's web interfaces can drive camera connectivity from the browser. The server accepts JSON command messages from localhost; the connectionInfo command is handled by a routine (referred to as handle_connection_info/handle_connect_info) that supplies details for connecting to a camera. The root cause is CWE-120 (buffer copy without checking size of input): the handler copies attacker-controlled JSON string fields, including the username, into fixed-size stack/heap buffers using manual byte-by-byte copy loops with no length enforcement, so an over-long value walks past the buffer boundary and corrupts adjacent memory. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:* across all listed versions.

RemediationAI

No vendor-released patch version was identified in the provided data; consult the GeoVision security page (https://www.geovision.com.tw/cyber_security.php) and the Talos advisory (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375) for an updated GeoWebPlayer build and apply it once available, citing the exact fixed version from the vendor rather than any assumed number. As compensating controls until a fix is applied: uninstall or disable the GeoWebPlayer/Web Plugin addon on hosts where the web-interface camera-connect feature is not required (trade-off: browser-based camera streaming/connection features that depend on the WebSocket server will stop working); restrict browser exposure on VMS operator workstations by limiting them to the trusted GeoVision management interface and blocking general web browsing, which reduces the chance of a malicious page reaching the localhost WebSocket (trade-off: reduced workstation usability); and where the platform allows, bind or firewall the local WebSocket listener so only the intended local origin can reach it. Because exploitation requires user interaction, operator security awareness and strict browsing hygiene on VMS machines are meaningful interim mitigations.