What is the CVSS score of CVE-2026-57277?

CVE-2026-57277 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57277?

GeoVision GeoWebPlayer plugin (used in GV-VMS, GV-Cloud, and related products) contains a stack buffer overflow enabling remote code execution (CVSS 8.3).

How to fix or mitigate CVE-2026-57277?

Within 24 hours: inventory all GeoVision product deployments and identify systems running GeoWebPlayer plugin; document current versions. Within 7 days: disable the GeoWebPlayer addon where operationally feasible; implement network segmentation to restrict local WebSocket service accessibility. Within 30 days: contact GeoVision support to confirm patch availability and timeline; if unavailable, evaluate alternative surveillance platforms or enforce restrictive web access policies on affected endpoints.

GeoWebPlayer CVE-2026-57277

EUVD-2026-41239 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-v6p4-q9gr-jf3p

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Browser-mediated cross-origin reach to a local process gives AV:N with S:C; UI:R for visiting a page, AC:H for reliable memory corruption, PR:N as no auth is needed.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:55 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in key field

AnalysisAI

Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cloud) lets an attacker corrupt fixed-size buffers and potentially achieve code execution against users of GV-VMS, GV-Cloud and related GeoVision products. The flaw lives in the local WebSocket server's connectionInfo command handler, which copies attacker-controlled JSON strings byte-by-byte without length checks; because a malicious web page loaded in the victim's browser can drive that local WebSocket, exploitation is scored network-reachable (CVSS 8.3) but requires user interaction and high attack complexity. No public exploit is identified at time of analysis, though the issue was reported by Cisco Talos, which typically develops proof-of-concept material.

Technical ContextAI

GeoWebPlayer is a companion addon that GeoVision video-management products (GV-VMS, GV-Cloud, VMS-Cloud) install to bridge their browser-based web interfaces to local functionality. It runs a WebSocket server that listens for commands from localhost, one of which - connectionInfo - supplies details for connecting to a camera. The handler (handle_connect_info / handle_connection_info) parses fields such as the camera 'key' out of the JSON payload and copies them into fixed-size buffers using manual byte-by-byte loops that never enforce the destination length, the classic CWE-120 (Classic Buffer Copy without Checking Size of Input) pattern. Because a WebSocket endpoint bound to localhost can still be reached cross-origin by JavaScript running in a page the user visits, an external web page can feed oversized strings into these copy loops, overflowing the buffer in the GeoWebPlayer process. Affected CPE: cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fix per GeoVision's security advisory at https://www.geovision.com.tw/cyber_security.php and cross-check the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375) for the patched GeoWebPlayer build; no exact fix version is provided in the available data, so verify the target version against the vendor page before deploying - patch available per vendor advisory. As a compensating control until patched, uninstall or disable the GeoWebPlayer / Web Plugin / WS Player addon where the GeoVision web interface is not actively required (trade-off: the affected web interfaces may lose functionality that depends on the local WebSocket bridge). If the addon must remain, restrict exposure by ensuring the WebSocket server binds only to loopback and, at the host firewall or endpoint policy, prevent untrusted browser sessions on that host, and instruct operators not to browse arbitrary sites from machines running GeoWebPlayer (trade-off: reduces convenience but breaks the malicious-page delivery path that the CVSS UI:R/AV:N scoring depends on).