EUVD-2026-41236
GHSA-pjcq-p37h-r7c4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N and UI:R reflect browser-to-localhost WebSocket attack path; PR:N as the WebSocket server requires no authentication; AC:H due to required bypass of memory-safety mitigations; S:C because browser-origin attack impacts a separate local process.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.
The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.
Buffer Overflow in password field (no key present)
AnalysisAI
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted connectionInfo WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in handle_connection_info overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system has GeoWebPlayer installed and its local WebSocket server actively running - the service is started as part of the GeoVision addon installation and may run as a persistent background process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a network-reachable, unauthenticated buffer overflow whose Changed Scope indicates that a component outside the immediate attack surface (the local GeoWebPlayer process) is impacted by an attacker operating from the browser origin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious webpage containing JavaScript that opens a WebSocket connection to the GeoWebPlayer service on localhost and sends a crafted `connectionInfo` command with a password field value substantially longer than the fixed-size destination buffer in `handle_connection_info`. When a surveillance operator visiting that page has GeoWebPlayer running in the background, the byte-by-byte copy loop overflows the buffer, corrupting adjacent memory and potentially redirecting execution to attacker-controlled code running with GeoWebPlayer's process privileges. … |
| Remediation | Consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php for vendor-released patch details - a specific fixed version was not independently confirmed from the available intelligence data (patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all GeoWebPlayer addon deployments; issue user security advisory emphasizing social engineering risks; clarify that no public exploit code has been identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geowebplayer
View allMissing authentication in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Clo
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS,
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with G
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VM
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) all
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cl
Out-of-bounds array access in GeoVision's GeoWebPlayer add-on (also branded 'Web Plugin' for GV-VMS and 'WS Player' for
Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read m
Out-of-bounds array indexing in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in V
Out-of-bounds array access in GeoVision GeoWebPlayer (a.k.a. "Web Plugin"/"WS Player"), a websocket-server addon bundled
Out-of-bounds array access in GeoVision's GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today