CVE-2026-57274: Buffer Overflow in GeoVision GeoWebPlayer WebSocket Server

Technical summary

The vulnerability resides in the `handle_connection_info` handler within GeoWebPlayer's websocket server. This handler processes JSON-formatted commands intended to supply camera connection parameters. The implementation uses manual byte-by-byte string copy loops that lack bounds checking, allowing attacker-controlled JSON fields (particularly the password field when no key is present) to overflow fixed-size stack or heap buffers. This classic CWE-120 (Buffer Copy without Checking Size of Input) condition can be triggered by sending oversized payloads via the localhost websocket interface, resulting in memory corruption that may be leveraged for arbitrary code execution in the context of the websocket server process.

Business impact

Compromise of a GeoWebPlayer-enabled surveillance system could allow an attacker with localhost access to gain code execution on the monitoring infrastructure. This threatens the confidentiality, integrity, and availability of video surveillance data and the systems that manage it—particularly critical for organizations relying on GeoVision deployments for physical security monitoring. An attacker with local network access could potentially pivot to broader network compromise or disable surveillance during a physical intrusion or data theft operation.

Affected systems

GeoWebPlayer (referred to as 'Web Plugin' in GV-VMS documentation and 'WS Player' in VMS-Cloud) affects deployments of GeoVision software including GV-VMS, GV-Cloud, and related products where this addon is installed. The vulnerability requires network access to the websocket server, which typically listens on localhost but may be exposed depending on deployment configuration. Any organization using GeoVision surveillance software with GeoWebPlayer enabled should be considered potentially affected pending vendor-specific patch availability.

Exploitability

Exploitation requires the attacker to have network access to the websocket server (typically restricted to localhost) and the ability to send crafted JSON payloads. The CVSS score of 8.3 (HIGH severity) reflects that while network access is required, this is often available to an insider, adjacent network segment, or via web browser interaction if the interface is exposed. The requirement for User Interaction (UI:R in the vector) suggests the attack may need triggering through a web interface action or social engineering. No public exploit code or KEV listing currently exists, but the straightforward nature of buffer overflow exploitation means proof-of-concept development would be feasible for skilled attackers.

Remediation

Immediate remediation requires updating GeoWebPlayer to a patched version released by GeoVision. Pending patch availability, restrict network access to the websocket server to trusted hosts only, disable GeoWebPlayer if not essential to operations, and ensure the GeoVision software runs with minimal privileges. Validate that your deployment's network segmentation isolates the surveillance system from untrusted network segments, particularly the internet.

Patch guidance

Check GeoVision's official security advisory and product update pages for GeoWebPlayer patches addressing this buffer overflow. Patch availability and version numbers should be verified against GeoVision's vendor advisory, as this information must be confirmed from official sources. Apply patches to all affected GeoVision installations in your environment, testing first in a non-production environment to ensure compatibility with your deployment.

Detection guidance

Monitor websocket server logs and network traffic for unusual payloads sent to the GeoWebPlayer service, particularly JSON messages with unexpectedly large field values or non-standard characters in the password or connection parameter fields. Network intrusion detection systems (IDS) should be configured to flag oversized or malformed JSON frames sent to known GeoVision websocket ports. Endpoint detection and response (EDR) tools should monitor for unexpected process spawning or memory corruption indicators originating from GeoWebPlayer processes. Review access logs to identify which hosts and users connect to the websocket interface.

Why prioritize this

While not yet on the CISA KEV catalog, this HIGH-severity buffer overflow in surveillance infrastructure warrants prompt prioritization due to the potential for unauthenticated code execution and the criticality of surveillance systems to physical security operations. Organizations should patch after confirming GeoVision's availability of fixes, but should not delay security architecture reviews to minimize localhost exposure in the interim.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects a HIGH-severity condition combining network accessibility, high confidentiality/integrity/integrity impact, and cross-system scope implications. The score is tempered by the requirement for high attack complexity and user interaction, recognizing that localhost-only exposure and the need to trigger the vulnerable code path reduce the attack surface compared to directly internet-exposed services. Organizations with properly segmented networks and minimal localhost exposure should rate their local risk lower, while those with web-exposed GeoVision interfaces or permissive network access should treat this as critical.

Frequently asked questions