Gv Asmanager
Monthly
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.