What is the CVSS score of CVE-2026-57278?

CVE-2026-57278 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57278?

GeoVision's video management addon contains a code execution vulnerability (CVSS 8.3) that affects authenticated users visiting malicious websites; no public exploit has been identified at time of…

How to fix or mitigate CVE-2026-57278?

Within 24 hours: Inventory all GeoVision video management system deployments, document versions, and notify users that the vulnerability requires authenticated browser access-instruct staff to avoid visiting suspicious links while authenticated to GeoVision systems. Within 7 days: Implement network controls restricting WebSocket server traffic to internal networks only; block all external connections to affected systems. Within 30 days: Establish vendor communication for patch timeline updates; evaluate alternative video management solutions if GeoVision's remediation plan is unacceptable.

GeoWebPlayer CVE-2026-57278

EUVD-2026-41240 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-cpch-mrj6-mv2v

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Browser-pivot to loopback gives AV:N with UI:R; overflow-to-RCE reliability makes AC:H; no auth to WebSocket (PR:N); crossing web-to-native trust boundary justifies S:C; memory corruption yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:56 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in ip field

AnalysisAI

Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) allows memory corruption and likely code execution in the local WebSocket server process. The handle_connection_info handler for the connectionInfo command copies attacker-controlled JSON strings (including the ip field) into fixed-size stack/heap buffers using unbounded byte-by-byte loops, so an oversized value overruns the buffer. Because the WebSocket server binds to localhost, exploitation is realistically driven by luring an authenticated user's browser to a malicious page that issues the command; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

GeoWebPlayer ships alongside GeoVision surveillance/VMS products (GV-VMS, GV-Cloud, etc.) and runs a local WebSocket server that bridges the vendor's browser-based web interfaces to native camera-connection functionality. Clients send JSON command messages such as connectionInfo, which supplies details needed to connect to a camera. The root cause is CWE-120 (Classic Buffer Overflow / copy without checking input size): handle_connect_info copies caller-supplied JSON string fields - notably ip - into fixed-size buffers using manual character-by-character copy loops with no length enforcement or bounds check, so any field longer than the destination buffer writes past its end and corrupts adjacent memory. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:* (all versions per the wildcard).

RemediationAI

No vendor-released patch version is identified in the available data at time of analysis; monitor the GeoVision cyber security page (https://www.geovision.com.tw/cyber_security.php) and the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375) for a fixed build and apply it once released, citing the exact version the vendor publishes. As compensating controls until a patch exists: uninstall or stop the GeoWebPlayer/Web Plugin addon on hosts that do not require the browser-based web interface (trade-off: the affected GeoVision web interfaces lose their camera-connection functionality); if it must run, restrict outbound browsing on the operator workstation and avoid visiting untrusted sites in the same session, since the attack is delivered through the browser reaching the localhost WebSocket; and use a host firewall or endpoint policy to limit which processes/origins can reach the local WebSocket port (trade-off: may require testing to avoid breaking the legitimate web UI). Do not expose the workstation's loopback service to remote networks.