EUVD-2026-41231
GHSA-g6qv-499j-qp84
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read memory, corrupt state, or crash the local WebSocket helper bundled with GV-VMS, GV-Cloud, and related surveillance software. The plugin's localhost WebSocket server processes commands (such as 'disconnect') that carry an attacker-controlled 'index' used to dereference internal arrays without bounds checking (CWE-129), yielding high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/UI:R/S:C) reflects a cross-origin browser-driven vector where a victim lured to a malicious page has their browser relay commands to the local WebSocket; there is no public exploit identified at time of analysis and no CISA KEV listing.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Geowebplayer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (GV) · only source for this CVE.
CVSS VectorVendor: GV
DescriptionCVE.org
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.
The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.
disconnect command index-out-of-bound
Executive ViewAI
GeoVision's GeoWebPlayer plugin, embedded in GV-VMS and GV-Cloud surveillance systems, contains a critical vulnerability (CVSS 8.3) that allows remote attackers to access sensitive surveillance data, corrupt system integrity, or disable monitoring infrastructure through browser-based social engineering. Organizations operating these surveillance systems face immediate risk to physical security oversight and compliance obligations. No vendor patch is available, requiring urgent defensive measures.
Within 24 hours: Identify and catalog all installations of GeoVision GV-VMS and GV-Cloud systems; implement firewall rules to restrict access to surveillance admin interfaces from external networks and untrusted sources. Within 7 days: Disable the bundled WebSocket helper service if operationally feasible; if required for operations, apply browser security policies (Content Security Policy) to prevent cross-origin command injection and require VPN-only access for all remote administration. Within 30 days: Escalate to GeoVision for patch availability and timeline; if remediation is not forthcoming, evaluate alternative surveillance solutions to reduce organizational risk.
Implement network segmentation isolating surveillance systems from general corporate networks; enforce VPN-only access for remote administration; deploy application-level filtering on WebSocket traffic to the helper service; implement Content Security Policy headers to prevent malicious cross-origin requests; enable MFA for all surveillance system administrative accounts; log and monitor WebSocket command traffic for anomalous patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB