GeoVision GV-ASmanager EUVD-2026-104031

Exploitation requires network reachability to the GeoWebServer.exe web service on its default connection port within a GeoVision GV-ASmanager deployment; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, so any attacker who can reach the default web port can trigger it. The primary limiting factor is exposure: GV-ASmanager is typically deployed on internal/management networks for physical access control, so real-world risk depends heavily on whether the web port is reachable from untrusted networks rather than segmented behind a firewall. Confirmed impact is availability loss (process crash); whether the overflow yields more than DoS is unverified.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remotely reachable, low-complexity, unauthenticated flaw whose ONLY impact is availability (C:N/I:N) - i.e. a denial-of-service crash of the GeoWebServer.exe process, not data theft or code execution as scored. This is notable because the CWE-121 classification (stack-based buffer overflow) and the 'Buffer Overflow/Stack Overflow' tags often signal RCE potential, yet the vendor-aligned CVSS deliberately assigns no confidentiality or integrity impact; this is a conflict that should be verified with GeoVision, because a stack overflow MAY be escalatable to code execution beyond the DoS the CVSS reflects. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine remote-unauthenticated DoS on a niche access-control product - a real but moderate priority (availability-only), not a widespread critical-RCE emergency, though the overflow nature warrants watching for a reclassification or a weaponized PoC.

An unauthenticated attacker with network reach to the GV-ASmanager host sends a crafted request to the default GeoWebServer.exe web service port, triggering a stack-based buffer overflow that crashes the process and disrupts the access-control management service. No public exploit code is currently identified, and because CVSS records only availability impact, the realistic outcome is service disruption rather than confirmed code execution.