GeoWebServer Command Injection and Stack Overflow

Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.

GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.