---METADATA---
VENDOR: GeoVision
PRODUCT: GV-ASWeb
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A remote code execution vulnerability exists in the Notification Settings of GeoVision GV-ASWeb 6.

Executive Summary:
A critical remote code execution flaw in GeoVision GV-ASWeb 6 allows unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-7841

Affected Software: GeoVision GV-ASWeb 6

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This remote code execution (RCE) vulnerability resides within the Notification Settings module. It allows an attacker to execute arbitrary code on the underlying system, likely without requiring prior authentication.

Business Impact

The CVSS score of 8.8 underscores the High severity of this vulnerability. Compromise of an access control or web management system can lead to total system takeover, unauthorized physical access, and potential pivot points into the internal network.

Remediation Plan

Immediate Action: Immediately restrict access to the GV-ASWeb interface to trusted internal networks and apply the latest security patches from GeoVision.

Proactive Monitoring: Review system logs for suspicious process creation or unusual outbound network traffic from the GV-ASWeb server.

Compensating Controls: Use a Web Application Firewall (WAF) with rules configured to block suspicious input patterns targeting notification settings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, RCE vulnerabilities are critical and require immediate remediation.

Analyst Recommendation

This vulnerability is exceptionally dangerous as it permits remote code execution. Systems running GeoVision GV-ASWeb must be isolated from the public internet immediately and patched to prevent potential exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-VMS
AFFECTED_VERSIONS: 20.0.2
---END_METADATA---

Description Summary:
A stack overflow in the GeoVision GV-VMS WebCam Server login functionality allows unauthenticated attackers to gain SYSTEM-level code execution via unconstrained sscanf calls.

Executive Summary:
A critical stack overflow in the GeoVision GV-VMS WebCam Server allows unauthenticated remote attackers to achieve full code execution as SYSTEM.

Vulnerability Details

CVE-ID: CVE-2026-7372

Affected Software: GeoVision GV-VMS

Affected Versions: 20.0.2

Vulnerability: The vulnerability exists due to an unconstrained sscanf call when processing authorization strings. If the username or password fields exceed 40 characters, a stack overflow occurs, permitting an attacker to execute code as SYSTEM.

Business Impact

With a CVSS score of 9.0, this vulnerability is highly critical. An attacker can compromise the entire machine hosting the GV-VMS service, leading to total loss of confidentiality, integrity, and availability for the surveillance infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware/software update for GeoVision GV-VMS to resolve the sscanf boundary checking issue.

Proactive Monitoring: Monitor for login attempts with malformed or excessively long credentials and watch for unexpected service behavior or system crashes.

Compensating Controls: Implement network-level access controls to restrict access to the WebCam Server and use a WAF to inspect and truncate overly long authorization headers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This flaw allows for remote code execution without authentication, presenting an extreme risk. Immediate patching is required to prevent attackers from gaining full control of the affected systems.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-LPC2011/2211
AFFECTED_VERSIONS: V1.12 and earlier
---END_METADATA---

Description Summary:
A stack-based buffer overflow in GeoVision GV-LPC2011/2211 allows remote, unauthenticated attackers to execute arbitrary code via crafted login data.

Executive Summary:
A critical buffer overflow vulnerability in GeoVision GV-LPC series devices poses a severe risk of remote code execution and total system compromise by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-57881

Affected Software: GeoVision GV-LPC2011/2211

Affected Versions: V1.12 and earlier

Vulnerability: This is a stack-based buffer overflow vulnerability triggered by insufficient length validation within the 'vlsvr' component when processing remote login data. The flaw allows an unauthenticated remote attacker to corrupt memory and potentially execute arbitrary code.

Business Impact

The CVSS score of 9.8 reflects the high probability of successful exploitation and the catastrophic impact on system integrity. Successful exploitation could lead to full unauthorized control over the physical security hardware, enabling attackers to bypass surveillance, exfiltrate sensitive data, or disable security monitoring capabilities entirely.

Remediation Plan

Immediate Action: Update the affected GeoVision GV-LPC2011/2211 devices to the latest available firmware version provided by the vendor.

Proactive Monitoring: Monitor network traffic for anomalous login attempts or malformed packets directed toward the 'vlsvr' service port.

Compensating Controls: Restrict network access to the device management interface using firewalls or VPNs to ensure only authorized personnel can communicate with the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this buffer overflow and the potential for remote code execution, immediate patching is required. Organizations utilizing these GeoVision units should prioritize firmware updates and isolate the affected devices from public-facing network segments until remediation is verified.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-LPC2011/2211
AFFECTED_VERSIONS: V1.12 and earlier
---END_METADATA---

Description Summary:
An unauthenticated stack-based buffer overflow in the ssvr component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted RTSP Digest authentication fields.

Executive Summary:
A critical buffer overflow vulnerability in GeoVision GV-LPC2011/2211 allows unauthenticated remote attackers to compromise the system through malicious RTSP authentication requests.

Vulnerability Details

CVE-ID: CVE-2026-57880

Affected Software: GeoVision GV-LPC2011/2211

Affected Versions: V1.12 and earlier

Vulnerability: The vulnerability is located in the ssvr process, specifically during the parsing of RTSP Digest authentication fields. By providing overly long authentication data in an RTSP request, an unauthenticated attacker can cause a stack-based buffer overflow.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this flaw, which allows for remote code execution. Potential consequences include unauthorized access to device management functions, data theft, or a complete denial of service, significantly impacting business continuity.

Remediation Plan

Immediate Action: Update the affected GeoVision firmware to the latest available version as specified in the manufacturer's security advisory.

Proactive Monitoring: Monitor network traffic for anomalous RTSP authentication patterns and watch for unexpected device behavior or service crashes.

Compensating Controls: If patching is not immediately feasible, isolate the affected devices on a restricted VLAN and limit RTSP access to trusted administrative workstations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides an unauthenticated path for remote code execution, making it a severe risk. Organizations must ensure that firmware updates are applied across all affected devices to eliminate the underlying memory corruption flaw.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-LPC2011/2211
AFFECTED_VERSIONS: V1.12 and earlier
---END_METADATA---

Description Summary:
An unauthenticated stack-based buffer overflow in the ssvr component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted RTSP requests.

Executive Summary:
An unauthenticated stack-based buffer overflow in the RTSP handling of GeoVision GV-LPC2011/2211 poses a critical risk of remote code execution or system failure.

Vulnerability Details

CVE-ID: CVE-2026-57879

Affected Software: GeoVision GV-LPC2011/2211

Affected Versions: V1.12 and earlier

Vulnerability: This flaw exists in the ssvr service and is caused by insufficient bounds checking when processing custom RTSP authentication data. An unauthenticated attacker can trigger this overflow by sending a crafted RTSP request to the target device.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a severe threat to the operational stability and security of the surveillance environment. Successful exploitation could lead to full device compromise, allowing an attacker to intercept video feeds or pivot into the internal network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by GeoVision to all vulnerable GV-LPC2011 and GV-LPC2211 devices immediately.

Proactive Monitoring: Review security logs for suspicious RTSP traffic and look for signs of service instability, such as repeated process restarts of the ssvr component.

Compensating Controls: Restrict access to the RTSP service by implementing firewall rules that limit communication to authorized management IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous as it impacts a core communication service on the device. IT administrators should treat this as a high-priority task and ensure all affected hardware is updated to the latest secure version to prevent exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-LPC2011/2211
AFFECTED_VERSIONS: V1.12 and earlier
---END_METADATA---

Description Summary:
An unauthenticated stack-based buffer overflow in the thttpd component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Executive Summary:
A critical stack-based buffer overflow in GeoVision GV-LPC2011/2211 allows unauthenticated remote attackers to achieve arbitrary code execution or cause system-wide denial of service.

Vulnerability Details

CVE-ID: CVE-2026-57878

Affected Software: GeoVision GV-LPC2011/2211

Affected Versions: V1.12 and earlier

Vulnerability: This vulnerability is a stack-based buffer overflow located in the thttpd web service, triggered by insufficient bounds checking on HTTP request parameters. An unauthenticated remote attacker can exploit this by sending a specially crafted, overly long HTTP request to a specific path.

Business Impact

The CVSS score of 9.8 reflects the high risk of full system compromise. Successful exploitation allows an attacker to gain unauthorized control over the device, potentially leading to total loss of confidentiality, integrity, and availability of the affected surveillance hardware.

Remediation Plan

Immediate Action: Update the firmware of all affected GeoVision GV-LPC2011 and GV-LPC2211 units to the latest available vendor-provided version.

Proactive Monitoring: Monitor device logs for unusual HTTP request patterns or frequent crashes of the thttpd service that may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter and block malformed HTTP requests targeting the device’s interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability and the ease with which an unauthenticated attacker can trigger the overflow, immediate patching is required. Organizations should prioritize the deployment of the vendor's firmware update to mitigate the risk of remote code execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-LPC2011/GV-LPC2211
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A format string vulnerability exists in the vlsvr component of GeoVision GV-LPC2011 and GV-LPC2211, allowing for potential unauthenticated remote code execution.

Executive Summary:
An unauthenticated format string vulnerability in GeoVision GV-LPC series devices poses a high risk of remote exploitation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-57877

Affected Software: GeoVision GV-LPC2011/GV-LPC2211

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a format string vulnerability residing in the vlsvr service. It permits an unauthenticated attacker to inject malicious format specifiers, potentially leading to memory corruption or arbitrary code execution.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a significant threat to operational security. Successful exploitation grants an attacker the ability to execute arbitrary code without prior authentication, potentially resulting in full system takeover, unauthorized data access, and disruption of critical monitoring services.

Remediation Plan

Immediate Action: Identify and isolate vulnerable GeoVision units from the public internet until a vendor-supplied patch is applied.

Proactive Monitoring: Review system and network logs for unusual traffic patterns directed at the vlsvr service, particularly strings containing format specifier characters.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict traffic to the affected devices, ensuring only authorized management workstations can communicate with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, immediate mitigation is required to prevent remote exploitation. Administrators should prioritize restricting network access to the affected hardware and coordinate with GeoVision to obtain and apply security updates as soon as they become available.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GeoVision GeoWebPlayer contains a high-severity security vulnerability affecting its integration with GV-VMS and GV-Cloud products.

Executive Summary:
A high-severity security flaw in the GeoVision GeoWebPlayer plugin poses a significant risk of unauthorized system interaction or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-57278

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the GeoWebPlayer add-on, which is utilized by various GeoVision software suites. The flaw potentially exposes the underlying host system to exploitation, though the specific attack vector requires further technical clarification from the vendor.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a substantial risk to organizational security. Exploitation could permit attackers to bypass security controls, resulting in the compromise of video management systems and potentially facilitating further unauthorized access to the corporate network.

Remediation Plan

Immediate Action: Audit systems for the presence of the GeoWebPlayer plugin and prepare to deploy patches as soon as the vendor provides remediation.

Proactive Monitoring: Monitor system logs for anomalous process execution or unauthorized configuration changes within the GeoVision environment.

Compensating Controls: Isolate surveillance systems from the public internet and utilize VPNs or zero-trust access controls to limit exposure to the vulnerable plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should maintain a high state of vigilance regarding this CVE. It is imperative to monitor official GeoVision support channels for patch releases and to apply all security updates immediately to ensure the integrity of the surveillance environment.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GeoVision GeoWebPlayer, an add-on for GV-VMS and GV-Cloud, contains a high-severity vulnerability that requires immediate attention.

Executive Summary:
The GeoVision GeoWebPlayer component is affected by a critical vulnerability that may allow unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-57277

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified security flaw within the GeoWebPlayer browser plugin component. The specific authentication requirements are currently undefined; however, such flaws in web-based surveillance components often allow for unauthenticated remote code execution or unauthorized information disclosure.

Business Impact

The identified vulnerability carries a CVSS score of 8.3, classifying it as High severity. Successful exploitation could lead to unauthorized access to live or recorded video surveillance feeds, potential lateral movement within the network, and significant reputational damage due to the compromise of sensitive security infrastructure.

Remediation Plan

Immediate Action: Identify all instances of GeoWebPlayer across the enterprise and verify against the vendor's latest security advisories for available patches.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from surveillance servers and review web server logs for suspicious request patterns.

Compensating Controls: Restrict access to the management interface of GV-VMS and GV-Cloud to authorized network segments and utilize a Web Application Firewall (WAF) to filter malicious traffic directed at the plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the identification of all vulnerable GeoVision deployments. It is critical to apply vendor-supplied updates immediately upon release to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been reported in the GeoWebPlayer addon, impacting various GeoVision software deployments.

Executive Summary:
A high-severity vulnerability in the GeoVision GeoWebPlayer component requires immediate attention to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-57276

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw affects the GeoWebPlayer addon, which is a core component for web-based interaction with GeoVision products such as GV-VMS, potentially exposing the system to malicious exploitation.

Business Impact

The CVSS score of 8.3 indicates a high risk to business operations, potentially leading to unauthorized data access or service disruption. Addressing this vulnerability is essential to protecting the integrity of the organization’s management software and the security of the data it processes.

Remediation Plan

Immediate Action: Immediately apply all available security updates or patches for the GeoWebPlayer addon as directed by the vendor.

Proactive Monitoring: Maintain heightened vigilance by reviewing access logs and monitoring for anomalous behavior linked to the GeoWebPlayer service.

Compensating Controls: Utilize network security controls to limit exposure of the web interface and deploy WAF configurations to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw warrants a proactive approach to remediation to mitigate risk.

Analyst Recommendation

Administrators should prioritize the deployment of patches for the GeoWebPlayer component to ensure all known vulnerabilities are addressed. Failure to act promptly could leave systems exposed to exploitation, making immediate remediation the highest priority.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the GeoWebPlayer addon used across multiple GeoVision software platforms.

Executive Summary:
The GeoVision GeoWebPlayer addon contains a high-severity security flaw that poses a substantial risk to the confidentiality and availability of the affected software.

Vulnerability Details

CVE-ID: CVE-2026-57275

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the GeoWebPlayer component, an addon utilized by GV-VMS and GV-Cloud, which may allow attackers to exploit flaws in the software's architecture.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a critical security gap that could lead to unauthorized system manipulation. Failure to remediate could result in severe operational disruption or the exposure of sensitive video management data to unauthorized actors.

Remediation Plan

Immediate Action: Locate all installations of the GeoWebPlayer addon and apply the latest security updates provided by GeoVision.

Proactive Monitoring: Regularly audit system logs for indicators of compromise and suspicious activity originating from the GeoWebPlayer service.

Compensating Controls: Deploy WAF rules designed to filter malicious requests targeting the GeoWebPlayer interface and restrict access to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploit data, the high severity justifies immediate attention.

Analyst Recommendation

Security administrators must treat this vulnerability as an urgent maintenance item. Prompt application of vendor-recommended updates is required to neutralize the threat and maintain the security posture of the GeoVision software environment.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the GeoWebPlayer addon for GeoVision software, potentially allowing unauthorized system impact.

Executive Summary:
The GeoVision GeoWebPlayer component is susceptible to a high-severity vulnerability that could facilitate unauthorized system access or compromise.

Vulnerability Details

CVE-ID: CVE-2026-57274

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the GeoWebPlayer addon, which is integrated with various GeoVision products such as GV-VMS and GV-Cloud, presenting a significant security risk to the host environment.

Business Impact

Successful exploitation of this vulnerability carries a significant risk to organizational infrastructure, as evidenced by its CVSS score of 8.3. Potential consequences include unauthorized access to surveillance data, system instability, or the compromise of administrative controls within the GeoVision ecosystem.

Remediation Plan

Immediate Action: Review the official GeoVision security portal and apply all relevant patches or updates to the GeoWebPlayer component immediately.

Proactive Monitoring: Monitor network traffic and server access logs for unusual patterns or unauthorized connection attempts directed at the GeoWebPlayer service.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to restrict access to the affected web-based components until patching is complete.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is considered significant.

Analyst Recommendation

Given the severity of this flaw, security teams must prioritize the identification of all instances of GeoWebPlayer within their network. Applying the vendor-supplied updates is the only definitive method to mitigate the risk of exploitation and ensure the integrity of the surveillance management infrastructure.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the GeoVision GeoWebPlayer addon necessitates urgent review and remediation to secure the affected management software.

Executive Summary:
The GeoVision GeoWebPlayer addon contains a high-severity vulnerability that could expose the host system to unauthorized exploitation.

Vulnerability Details

CVE-ID: CVE-2026-57273

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer addon, a common feature in GeoVision software. The issue involves a flaw that could be leveraged by an attacker to compromise the security posture of the application's web component.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant risk to the security of the organization's video management infrastructure. Potential consequences include unauthorized access to administrative controls and the compromise of sensitive surveillance data, which could lead to significant operational disruptions.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to remediate the vulnerability in the GeoWebPlayer component.

Proactive Monitoring: Review application logs for signs of unusual activity, particularly focusing on the web interface and plugin interactions.

Compensating Controls: Utilize network-level defenses, such as restricting access to the web interface and deploying a WAF to mitigate potential exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability warrants immediate action. IT and security teams are advised to track the release of security updates from GeoVision and apply them to all affected systems as a matter of urgency to prevent potential exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the GeoVision GeoWebPlayer, requiring immediate attention to prevent potential exploitation.

Executive Summary:
The GeoVision GeoWebPlayer addon is subject to a high-severity vulnerability that could allow attackers to compromise the integrity or availability of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-57272

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the GeoWebPlayer addon, which is integrated into various GeoVision software suites. The flaw may allow for remote interaction with the plugin that could lead to unauthorized execution or information disclosure.

Business Impact

The high CVSS score of 8.3 underscores the critical nature of this vulnerability. If left unpatched, the risk includes unauthorized access to sensitive video management data, potentially leading to a total loss of confidentiality and integrity within the organization's security monitoring infrastructure.

Remediation Plan

Immediate Action: Identify all instances of GeoWebPlayer and apply vendor-supplied security patches as soon as they are released.

Proactive Monitoring: Monitor system logs for unusual authentication attempts or unauthorized commands executed via the web interface.

Compensating Controls: Restrict access to the management console to trusted IP addresses and employ WAF rules to block suspicious traffic patterns targeting the plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize the remediation of this vulnerability by monitoring the GeoVision support portal for patch releases. Immediate deployment of updates is the most effective method to neutralize this risk and ensure continued system security.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: GeoVision GeoWebPlayer prior to V1.1.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An array index out-of-bounds vulnerability in GeoWebPlayer triggered by a 'pause' command can cause system instability and potential security compromises.

Executive Summary:
A high-severity out-of-bounds access vulnerability in GeoVision GeoWebPlayer allows remote attackers to disrupt system availability and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-57271

Affected Software: GeoVision GeoWebPlayer

Affected Versions: GeoVision GeoWebPlayer prior to V1.1.3.0

Vulnerability: The vulnerability involves improper validation of an array index (CWE-129) during the processing of a 'pause' command. This index-out-of-bound condition can lead to memory corruption or application crashes.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk to the availability and stability of surveillance systems. Successful exploitation could result in service denial or potential code execution, leading to significant operational downtime and the loss of critical video monitoring capabilities.

Remediation Plan

Immediate Action: Update the GeoWebPlayer component to version V1.1.3.0 or later to patch the index validation logic.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected service restarts, which may indicate an attempt to trigger this crash condition.

Compensating Controls: Restrict network access to the affected VMS interfaces to authorized personnel only, reducing the attack surface available to potential adversaries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for system disruption, immediate patching is required. Organizations should treat this as a critical maintenance task to ensure the continued stability and security of their video management infrastructure.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the GeoVision GeoWebPlayer addon, requiring immediate attention to secure the affected environment.

Executive Summary:
A high-severity security vulnerability in the GeoVision GeoWebPlayer plugin poses a serious risk to system integrity and requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-57270

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer addon, which is a common dependency for GeoVision's surveillance management software. The flaw, rated at 8.3 on the CVSS scale, indicates a high risk of exploitation that could lead to unauthorized access.

Business Impact

The CVSS score of 8.3 underscores the potential for severe business impact, including unauthorized access to critical monitoring infrastructure. Such an event could lead to a loss of operational integrity and potential reputational damage if the security of the surveillance network is breached.

Remediation Plan

Immediate Action: Identify all affected GeoVision systems and apply the latest security patches provided by the vendor.

Proactive Monitoring: Audit server logs for unexpected access patterns or unauthorized administrative actions.

Compensating Controls: Implement network segmentation to isolate systems running GeoWebPlayer from critical business segments, reducing the potential impact of a breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploit data, the high-severity classification warrants immediate patching.

Analyst Recommendation

Organizations should prioritize the remediation of CVE-2026-57270 by ensuring all GeoVision software is updated to the latest secure version. Rapid response is essential to mitigate the high risk associated with this vulnerability and to maintain the security of the surveillance environment.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the GeoVision GeoWebPlayer addon poses a high risk to the integrity and security of the host software environment.

Executive Summary:
The GeoVision GeoWebPlayer addon contains a high-severity security flaw that could allow an attacker to compromise the host system's security posture.

Vulnerability Details

CVE-ID: CVE-2026-57269

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts the GeoWebPlayer plugin used across GeoVision VMS and Cloud products. The vulnerability represents a significant risk, and users should treat the interface as a potential attack vector until vendor-supplied mitigations are applied.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a substantial threat to organizational security. Compromise of the GeoWebPlayer could lead to unauthorized control of surveillance infrastructure, resulting in loss of physical security visibility and potential exposure of sensitive operational data.

Remediation Plan

Immediate Action: Verify the version of GeoWebPlayer in use and apply all available security updates provided by GeoVision.

Proactive Monitoring: Implement strict monitoring of network traffic to and from the GeoWebPlayer service to identify anomalies.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block suspicious requests targeting the plugin interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity rating necessitates proactive defensive measures.

Analyst Recommendation

Security teams must treat this vulnerability with urgency. It is recommended to perform a comprehensive inventory of all GeoVision instances and apply the necessary patches as soon as they are made available by the vendor to prevent unauthorized exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the GeoVision GeoWebPlayer addon, potentially allowing for unauthorized system impact.

Executive Summary:
The GeoVision GeoWebPlayer component is susceptible to a high-severity vulnerability that could lead to significant security compromises if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-57268

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer addon, which is integrated with various GeoVision software suites. The specific technical nature of the flaw requires further vendor clarification, but it necessitates authentication analysis to determine if remote unauthenticated access is possible.

Business Impact

The vulnerability carries a CVSS score of 8.3, classifying it as a High-severity risk. Successful exploitation could result in unauthorized access to sensitive surveillance systems, potential data exfiltration, or complete system compromise, leading to severe operational downtime and regulatory non-compliance.

Remediation Plan

Immediate Action: Consult the official GeoVision security portal to identify and apply the latest security patches or firmware updates.

Proactive Monitoring: Review system and access logs for unusual activity or unauthorized connection attempts originating from the GeoWebPlayer service.

Compensating Controls: Restrict network access to GeoVision management interfaces using VPNs or firewall rules to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant and requires prompt attention.

Analyst Recommendation

Given the severity of this vulnerability, organizations utilizing GeoVision software should prioritize identifying if their deployments include the vulnerable GeoWebPlayer component. Administrators must monitor vendor communications for patch availability and apply updates immediately upon release to mitigate potential exposure.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the GeoVision GeoWebPlayer addon, potentially allowing for unauthorized system interaction.

Executive Summary:
The GeoVision GeoWebPlayer addon is susceptible to a high-severity vulnerability that could lead to significant security compromises within the host environment.

Vulnerability Details

CVE-ID: CVE-2026-57267

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the GeoWebPlayer component of GeoVision software suites. The flaw poses a significant security risk, requiring prompt investigation and remediation to address the underlying software defect.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a substantial risk to the organization's security posture. Exploitation could allow adversaries to bypass existing security controls, leading to unauthorized access to critical monitoring infrastructure and potentially compromising sensitive surveillance data.

Remediation Plan

Immediate Action: Review the official GeoVision advisory to identify the correct remediation steps and apply necessary software updates or patches.

Proactive Monitoring: Review audit trails and system logs specifically for any suspicious activity linked to the GeoWebPlayer component.

Compensating Controls: Utilize perimeter defense mechanisms such as WAFs or VPNs to limit exposure of the affected software to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is critical that administrators address this High severity vulnerability without delay. By applying the recommended vendor updates and maintaining rigorous monitoring, organizations can effectively mitigate the threat of exploitation and maintain the integrity of their GeoVision software deployment.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the GeoVision GeoWebPlayer addon, potentially allowing for unauthorized system interaction.

Executive Summary:
The GeoVision GeoWebPlayer addon is susceptible to a high-severity vulnerability that could lead to significant security compromises within the host environment.

Vulnerability Details

CVE-ID: CVE-2026-57266

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer component, which serves as a critical addon for GV-VMS and GV-Cloud installations. The flaw introduces a high-risk security gap that requires immediate attention to prevent unauthorized exploitation of the plugin.

Business Impact

The identified vulnerability carries a CVSS score of 8.3, indicating a high potential for impact on confidentiality, integrity, and availability. Failure to remediate this issue could result in an attacker gaining unauthorized control over surveillance systems, leading to severe reputational damage and potential loss of physical security integrity.

Remediation Plan

Immediate Action: Verify the version of GeoWebPlayer in use and apply the latest security updates provided by GeoVision.

Proactive Monitoring: Monitor network traffic and server logs for anomalous behavior associated with the GeoWebPlayer addon or the associated VMS software.

Compensating Controls: Deploy strict network segmentation and WAF policies to filter malicious requests directed toward the GeoVision management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability as a priority due to its High severity classification. It is essential to monitor vendor communication channels for specific patch deployment instructions and to apply these updates as soon as they become available to ensure the continued security of the surveillance infrastructure.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the GeoVision GeoWebPlayer addon, potentially allowing for unauthorized system interaction.

Executive Summary:
The GeoVision GeoWebPlayer addon is susceptible to a high-severity vulnerability that could lead to significant security compromises within the host environment.

Vulnerability Details

CVE-ID: CVE-2026-57265

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer component, commonly utilized within GV-VMS and GV-Cloud environments. The flaw allows for potential exploitation by an attacker, though specific authentication requirements depend on the implementation details provided in the vendor advisory.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, potentially leading to unauthorized data access or total system compromise. With a CVSS score of 8.3, this flaw is categorized as High severity and necessitates immediate remediation to prevent operational disruption and loss of sensitive surveillance data.

Remediation Plan

Immediate Action: Consult the official GeoVision security advisory to identify and apply the necessary patches or configuration changes.

Proactive Monitoring: Review system and application access logs for unusual patterns or unauthorized connection attempts originating from the GeoWebPlayer component.

Compensating Controls: Implement network-level access controls and Web Application Firewall (WAF) rules to restrict traffic to the affected management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating of this vulnerability, immediate action is required to secure the environment. Organizations should prioritize verifying their version status against the vendor’s guidance and applying all recommended updates to mitigate the risk of unauthorized access or exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the GeoVision GeoWebPlayer plugin may expose integrated software products to unauthorized exploitation.

Executive Summary:
A high-severity security flaw in the GeoVision GeoWebPlayer plugin poses a serious threat to the security posture of systems utilizing GeoVision management software.

Vulnerability Details

CVE-ID: CVE-2026-57264

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer component, which is a common addon for GV-VMS and GV-Cloud. The flaw could potentially be leveraged by an attacker to gain unauthorized access or influence the behavior of the host application.

Business Impact

The CVSS score of 8.3 underscores the critical nature of this vulnerability. Organizations face the risk of data exfiltration and unauthorized system access, which could significantly impact the reliability and security of video surveillance operations.

Remediation Plan

Immediate Action: Identify all instances of GeoWebPlayer within the environment and apply the latest security updates provided by GeoVision.

Proactive Monitoring: Review application logs for any suspicious or irregular behavior linked to the web plugin and its communication with the core software.

Compensating Controls: Use network-level controls, such as firewalls and VPNs, to restrict access to the affected software until a verified patch can be successfully deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. Regardless, given the high-severity classification, the risk of exploitation remains a concern for all deployments.

Analyst Recommendation

It is strongly recommended that administrators perform a thorough audit of their GeoVision software installations. Immediate patching is required to address this vulnerability and ensure the continued security and integrity of the affected management systems.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-VMS
AFFECTED_VERSIONS: 20.0.2
---END_METADATA---

Description Summary:
A stack overflow in the WebCam Server Login functionality of GeoVision GV-VMS 20.0.2 allows unauthenticated remote attackers to achieve arbitrary code execution.

Executive Summary:
A critical stack overflow vulnerability in the GeoVision GV-VMS WebCam Server allows unauthenticated attackers to execute arbitrary code via a crafted HTTP request.

Vulnerability Details

CVE-ID: CVE-2026-42370

Affected Software: GeoVision GV-VMS

Affected Versions: 20.0.2

Vulnerability: This is a stack overflow vulnerability found in the WebCam Server's login process. An attacker can send a malicious, unauthenticated HTTP request that triggers the overflow, leading to potential code execution.

Business Impact

A CVSS score of 9.0 confirms the critical nature of this flaw. Successful exploitation allows an attacker to gain control over the GV-VMS system, which could result in unauthorized surveillance access, system disruption, or lateral movement into the network.

Remediation Plan

Immediate Action: Upgrade to the latest version of GeoVision GV-VMS to remediate the stack overflow vulnerability.

Proactive Monitoring: Monitor for abnormal traffic patterns targeting the WebCam Server login page and check for service instability or unexpected process restarts.

Compensating Controls: Use a WAF to restrict access to the WebCam Server interface and block requests containing unusually large payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated remote code execution, this vulnerability poses a severe risk. Organizations should prioritize updating their GV-VMS deployments and ensure that management interfaces are not exposed to untrusted networks.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-VMS
AFFECTED_VERSIONS: V20
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the GV-VMS WebCam Server gvapi endpoint allows remote attackers to gain SYSTEM-level code execution via a specially crafted HTTP Authorization header.

Executive Summary:
A critical stack-based buffer overflow in GeoVision GV-VMS allows unauthenticated remote attackers to achieve full code execution as SYSTEM due to the absence of ASLR.

Vulnerability Details

CVE-ID: CVE-2026-42369

Affected Software: GeoVision GV-VMS

Affected Versions: V20

Vulnerability: The vulnerability occurs in the gvapi endpoint, which fails to perform bounds checking when processing base64-decoded strings from the HTTP Authorization header. This allows an attacker to overwrite the stack, leading to arbitrary code execution.

Business Impact

Given the CVSS score of 10, this is a maximum-severity vulnerability. Exploitation allows an attacker to gain full control over the host running the GV-VMS service with SYSTEM privileges, enabling data theft, lateral movement, and complete compromise of the surveillance network.

Remediation Plan

Immediate Action: Apply the vendor-provided security update for GV-VMS V20 immediately.

Proactive Monitoring: Monitor for anomalous spikes in traffic to the gvapi endpoint and review host logs for unauthorized binary execution or service crashes.

Compensating Controls: If a patch cannot be applied, disable the "WebCam Server" feature if it is not strictly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires urgent remediation. The lack of ASLR in the affected component makes exploitation highly reliable; therefore, administrators must prioritize updating the GV-VMS software to prevent potential system-wide compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: 1.10
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the GeoVision LPC2011/LPC2211 web interface allows an attacker to execute privileged operations via a crafted HTTP request.

Executive Summary:
A critical privilege escalation vulnerability in GeoVision LPC2011/LPC2211 devices allows unauthorized users to perform administrative actions, potentially leading to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-42368

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: 1.10

Vulnerability: This is a privilege escalation flaw in the web interface. By sending a specially crafted HTTP request, an attacker can bypass standard access controls to execute administrative or privileged functions.

Business Impact

With a CVSS score of 9.9, this vulnerability presents a critical risk. If exploited, an attacker could change device settings, disable security features, or gain unauthorized administrative access, compromising the integrity of the surveillance feed and the device itself.

Remediation Plan

Immediate Action: Update the firmware for the GeoVision LPC2011/LPC2211 to the latest version to address the privilege escalation flaw.

Proactive Monitoring: Review access logs for unauthorized administrative requests and monitor for changes to device configurations that were not performed by authorized personnel.

Compensating Controls: Limit access to the device web management interface to internal, trusted networks and implement multi-factor authentication where supported.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this privilege escalation vulnerability with high urgency. Patching the device firmware is the only reliable way to ensure that administrative functions remain protected from unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A guessable session cookie vulnerability in the GeoVision LPC2011/LPC2211 web interface allows unauthorized access to administrative sessions.

Executive Summary:
A high-severity session management flaw in GeoVision LPC2011/LPC2211 devices allows attackers to hijack administrative sessions, potentially leading to complete device compromise.

Vulnerability Details

CVE-ID: CVE-2026-42365

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: See vendor advisory for affected versions

Vulnerability: The web interface employs guessable session cookies, which can be exploited by an attacker to bypass authentication mechanisms and impersonate an active administrative user.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a high risk to organizational security. Successful session hijacking grants the attacker full control over the device configuration, allowing them to manipulate settings and compromise the device's intended function.

Remediation Plan

Immediate Action: Update the firmware for the affected GeoVision devices to the latest version to address the session management weakness.

Proactive Monitoring: Review web access logs for unusual session cookie patterns or multiple logins from the same session ID.

Compensating Controls: Restrict access to the web interface to trusted management networks and, where possible, use a WAF to monitor for suspicious cookie activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should act promptly to update their GeoVision devices. Session hijacking is a common attack vector, and remediating this flaw is essential to ensuring that administrative sessions remain secure and private.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: 1.10
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 allows arbitrary command execution via crafted DDNS configuration.

Executive Summary:
A critical OS command injection vulnerability in GeoVision LPC2011/LPC2211 devices allows unauthenticated attackers to execute arbitrary commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-42364

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: 1.10

Vulnerability: This vulnerability is an OS command injection flaw located within the DdnsSetting.cgi script. By providing a specially crafted DDNS configuration value, an attacker can bypass input validation to execute system-level commands.

Business Impact

Successful exploitation of this vulnerability grants the attacker the ability to execute arbitrary commands on the affected hardware, which can result in full system takeover, data exfiltration, or the inclusion of the device into a botnet. Given the CVSS score of 9.9, this represents an extreme risk to network integrity and operational continuity, as compromised surveillance equipment can serve as an entry point into the wider corporate network.

Remediation Plan

Immediate Action: Upgrade the GeoVision LPC2011/LPC2211 firmware to the latest version provided by the vendor to patch the injection vector.

Proactive Monitoring: Inspect system and web access logs for unusual requests directed at DdnsSetting.cgi or unexpected shell execution commands.

Compensating Controls: Implement strict network segmentation for IoT and surveillance devices and utilize a Web Application Firewall (WAF) to filter malicious input strings from configuration requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Organizations utilizing these GeoVision devices must prioritize firmware updates to close the command injection vector and prevent unauthorized remote code execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the GeoVision GeoWebPlayer plugin, which is integrated into various GeoVision software suites.

Executive Summary:
The GeoVision GeoWebPlayer plugin contains a high-severity security vulnerability that could lead to unauthorized system access and potential compromise of the management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-13132

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the GeoWebPlayer addon, impacting its integration with GV-VMS and GV-Cloud. It is essential to treat this as a potential vector for unauthorized administrative-level actions depending on the specific implementation of the plugin.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a substantial risk to organizational security. Exploitation could allow malicious actors to gain unauthorized control over video management systems, leading to data breaches or the loss of availability for critical surveillance infrastructure.

Remediation Plan

Immediate Action: Check the GeoVision support documentation for relevant security updates and apply them to all affected deployments of GeoWebPlayer.

Proactive Monitoring: Inspect system logs for unusual activity or unauthorized execution attempts associated with the GeoWebPlayer plugin.

Compensating Controls: Implement network segmentation to isolate affected systems and utilize WAF or IPS signatures to detect and block potential exploit payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the severity rating necessitates proactive patching to prevent potential future exploitation.

Analyst Recommendation

System administrators must treat this vulnerability with high priority. Organizations should verify their current GeoWebPlayer versions against the vendor’s advisory and ensure that all necessary security patches are applied to eliminate the exposure.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the GeoVision GeoWebPlayer plugin, potentially allowing unauthorized access or system impact.

Executive Summary:
The GeoVision GeoWebPlayer plugin is susceptible to a high-severity vulnerability that poses a significant risk to the security and integrity of host systems.

Vulnerability Details

CVE-ID: CVE-2026-13131

Affected Software: GeoVision GeoWebPlayer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GeoWebPlayer addon used within GV-VMS and GV-Cloud environments. While specific technical triggers are pending vendor disclosure, vulnerabilities in such plugins often permit unauthenticated remote code execution or unauthorized system manipulation.

Business Impact

The vulnerability carries a CVSS score of 8.3, classifying it as a High-severity risk. Successful exploitation could lead to full system compromise, unauthorized data access, and the potential disruption of critical video management services, resulting in significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Review the official GeoVision security portal to identify and apply the latest available security patches or configuration updates for the GeoWebPlayer plugin.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns or unauthorized attempts to interface with the GeoWebPlayer plugin components.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter suspicious requests targeting the plugin and restrict network access to the affected management interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant and requires immediate attention from system administrators.

Analyst Recommendation

Given the High severity of this flaw, organizations utilizing GeoVision software should prioritize the identification of affected systems. Administrators must apply vendor-supplied patches immediately upon release to mitigate the risk of unauthorized system access or remote exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GeoWebPlayer
AFFECTED_VERSIONS: GeoWebPlayer prior to V1.1.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A lack of authentication in the GeoWebPlayer websocket server allows unauthorized websites to remotely execute commands and capture sensitive user screen content.

Executive Summary:
The GeoVision GeoWebPlayer is affected by an authentication bypass vulnerability that permits unauthorized actors to access screen capture data and system functions.

Vulnerability Details

CVE-ID: CVE-2026-13125

Affected Software: GeoVision GeoWebPlayer

Affected Versions: GeoWebPlayer prior to V1.1.3.0

Vulnerability: This vulnerability is an improper access control issue (CWE-284) where the websocket server fails to authenticate connections. Unauthenticated remote attackers can leverage this to invoke sensitive methods such as 'create' or 'getScreenCapture'.

Business Impact

The exploitation of this vulnerability could lead to a significant breach of confidentiality, as attackers can remotely view live screen content from systems running the affected software. Given its CVSS score of 8.8, this is a High-severity risk that could facilitate reconnaissance or unauthorized surveillance of sensitive operational environments.

Remediation Plan

Immediate Action: Update the GeoWebPlayer component to version V1.1.3.0 or later as specified in the vendor advisory.

Proactive Monitoring: Review websocket traffic and system access logs for anomalous connection attempts or calls to 'getScreenCapture' functions.

Compensating Controls: Implement network-level access controls to restrict connections to the websocket server to known, trusted management IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to privacy and system integrity. Administrators should prioritize the deployment of the V1.1.3.0 update across all GeoVision VMS and Cloud deployments to mitigate the risk of unauthorized remote interaction.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E allows unauthenticated attackers to execute arbitrary system commands via the DNS configuration interface.

Vulnerability Details

CVE-ID: CVE-2026-12851

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The CNetSetObj::m_F_n_Set_DNS_Addr function fails to sanitize user-supplied DNS addresses before executing them as shell commands. This allows an unauthenticated attacker to inject arbitrary commands through the DVRSearch service or Network.cgi.

Business Impact

The CVSS score of 9.1 reflects the high severity of this vulnerability. Successful exploitation permits an attacker to execute commands with the privileges of the application, which could lead to full system takeover and persistent unauthorized access to the environment.

Remediation Plan

Immediate Action: Update the GeoVision GV-I/O Box 4E to the latest firmware version released by the vendor.

Proactive Monitoring: Review system configuration logs and monitor for unexpected changes to /etc/resolv.conf or other system files.

Compensating Controls: Restrict network access to the device so that only trusted management consoles can interact with the vulnerable network configuration endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for remote exploitation, immediate remediation is required. Security teams should ensure the latest firmware is deployed across all affected devices to prevent potential system compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E allows unauthenticated attackers to execute arbitrary system commands by manipulating gateway configuration parameters.

Vulnerability Details

CVE-ID: CVE-2026-12850

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The CNetSetObj::m_F_n_Set_Gate_way function contains a command injection flaw due to insufficient input validation. An unauthenticated attacker can exploit this by sending a crafted request to the DVRSearch service or Network.cgi to execute arbitrary commands.

Business Impact

With a CVSS score of 9.1, this vulnerability is classified as critical. Exploitation could result in a complete loss of confidentiality, integrity, and availability of the affected device, potentially facilitating further attacks on the internal network infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware update for the GeoVision GV-I/O Box 4E as specified by the vendor.

Proactive Monitoring: Monitor system logs for unusual execution patterns or unauthorized modification of network routing configurations.

Compensating Controls: Utilize a Web Application Firewall (WAF) or network ACLs to block unauthorized access to the device's management endpoints until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of triggering this command injection makes it an attractive target for attackers. It is imperative that security teams verify their firmware versions and deploy the necessary updates to secure the device against unauthorized remote command execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E enables unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-12849

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The vulnerability exists within the CNetSetObj::m_F_n_Set_Net_Mask function, which fails to sanitize input before passing it to a system call. This flaw is remotely reachable by unauthenticated attackers via the DVRSearch service or Network.cgi endpoint.

Business Impact

A successful exploit allows full remote command execution with system-level privileges. Given the CVSS score of 9.1, this vulnerability presents a critical risk, potentially leading to total device compromise, unauthorized network access, and the potential for lateral movement within the production environment.

Remediation Plan

Immediate Action: Update the GeoVision GV-I/O Box 4E firmware to the latest available version provided by the vendor.

Proactive Monitoring: Inspect network traffic for anomalous requests directed at the DVRSearch service or Network.cgi endpoint.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interfaces to authorized IP addresses only, reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security failure that could lead to complete device takeover. Administrators must prioritize applying the vendor-supplied security update immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The GeoVision GV-I/O Box 4E contains a stack-based buffer overflow vulnerability in the DVRSearch service, allowing remote code execution via crafted UDP packets.

Executive Summary:
A critical stack-based buffer overflow in the GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-12848

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the DVRSearch service, which listens on UDP port 10001. An unauthenticated attacker can trigger a stack overflow by sending a maliciously crafted UDP packet, leading to potential remote code execution.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation grants an attacker full control over the affected smart embedded device, enabling them to pivot into the internal network, disrupt physical security operations, or use the device as a persistent foothold for further malicious activity.

Remediation Plan

Immediate Action: Patch the device to the latest firmware version provided by GeoVision as soon as it becomes available.

Proactive Monitoring: Inspect network traffic directed to UDP port 10001 for anomalous packet sizes or malformed payloads.

Compensating Controls: Restrict network access to the GV-I/O Box 4E by placing it behind a firewall and allowing traffic only from trusted, authorized management IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this flaw and the potential for complete device compromise, immediate action is required. Organizations should isolate the affected hardware from public-facing networks and apply vendor-supplied updates immediately upon release to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated remote attackers to execute arbitrary code via crafted UDP packets.

Executive Summary:
The GeoVision GV-I/O Box 4E is susceptible to a critical stack overflow vulnerability that allows unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12847

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a stack-based buffer overflow in the DVRSearch service, triggered when processing network configuration data. An unauthenticated attacker can send a malicious UDP packet to port 10001, causing memory corruption and potential code execution.

Business Impact

A successful exploit grants an attacker full control over the affected I/O device, which may be leveraged to manipulate physical relays or pivot into the internal network. Given the CVSS score of 10.0, this represents a maximum-severity risk that could lead to complete system compromise and severe operational disruption.

Remediation Plan

Immediate Action: Update the firmware of all affected GeoVision GV-I/O Box 4E units to the latest version provided by the vendor.

Proactive Monitoring: Inspect network traffic for anomalous UDP packets directed at port 10001 and monitor device logs for unexpected service restarts.

Compensating Controls: Restrict network access to the GV-I/O Box 4E using firewall rules, ensuring the device is not reachable from untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Organizations utilizing GeoVision GV-I/O Box 4E devices must prioritize firmware updates and network isolation to prevent unauthorized remote access and potential physical manipulation of connected systems.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the DVRSearch service allows unauthenticated remote attackers to execute arbitrary code via crafted UDP packets.

Executive Summary:
The GeoVision GV-I/O Box 4E is susceptible to a critical stack-based buffer overflow vulnerability that allows unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12846

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists within the DVRSearch service, which processes UDP messages on port 10001. An unauthenticated attacker can send a specially crafted packet that triggers a stack overflow via an insecure memcpy operation, leading to potential system compromise.

Business Impact

Given the CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation grants an attacker full control over the embedded device, potentially allowing them to pivot into the internal network, disrupt physical security controls connected to the I/O box, or facilitate further lateral movement.

Remediation Plan

Immediate Action: Update the firmware of the GeoVision GV-I/O Box 4E to the latest available version provided by the vendor.

Proactive Monitoring: Monitor network traffic for anomalous UDP activity directed at port 10001 and audit system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement strict network segmentation and utilize a firewall to restrict access to the device's management ports, ensuring only authorized management stations can communicate with the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of network access, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a critical threat to infrastructure integrity. Administrators must prioritize applying firmware patches immediately to eliminate the risk of remote exploitation. If patching is not immediately feasible, isolate the affected devices from external network exposure to prevent unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
Multiple OS command injection vulnerabilities in the GeoVision GV-I/O Box 4E allow remote attackers to execute arbitrary commands via crafted network packets.

Executive Summary:
A critical command injection vulnerability in GeoVision GV-I/O Box 4E allows remote attackers to execute system commands through unauthenticated network requests.

Vulnerability Details

CVE-ID: CVE-2026-12486

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The internal library libNetSetObj.so fails to sanitize input before passing it to the system() call within the CNetSetObj::m_F_n_Set_IP_Addr function. This flaw is reachable via the network-exposed DVRSearch service and Network.cgi endpoint, allowing remote command injection.

Business Impact

With a CVSS score of 9.1, this vulnerability poses an extreme risk, as it allows attackers to gain persistent access to the hardware device. This can lead to device takeover, credential theft, and the use of the device as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Update the firmware of the GV-I/O Box 4E to the latest version provided by the vendor.

Proactive Monitoring: Monitor network traffic for suspicious requests targeting the DVRSearch service or Network.cgi endpoint, specifically looking for shell metacharacters in parameters.

Compensating Controls: Restrict network access to the management interfaces of the I/O Box using network segmentation or firewall rules to limit exposure to trusted internal segments only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights significant security deficiencies in the device's network configuration handling. Administrators must apply the latest firmware updates immediately and restrict management access to the device to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The GeoVision GV-I/O Box 4E contains a stack-based buffer overflow in the DVRSearch service, allowing unauthenticated attackers to trigger remote code execution via malformed UDP packets.

Executive Summary:
A critical stack-based buffer overflow in the GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to execute arbitrary code by sending crafted UDP packets to the device.

Vulnerability Details

CVE-ID: CVE-2026-12485

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The DVRSearch service, which listens on UDP port 10001, contains a stack-based buffer overflow. An attacker can send a malformed UDP message that, when processed, causes an out-of-bounds copy into a local buffer, leading to memory corruption and potential code execution.

Business Impact

The CVSS score of 10.0 reflects the critical nature of this vulnerability, as it allows unauthenticated remote code execution on an embedded device. An attacker could gain full control over the I/O Box, potentially manipulating physical relays or using the device as a foothold for further attacks on the internal network.

Remediation Plan

Immediate Action: Consult the official GeoVision security advisory and apply the latest firmware update to address the buffer overflow in the DVRSearch service.

Proactive Monitoring: Monitor network traffic for unusual or malformed UDP packets sent to port 10001 and review device logs for signs of service crashes or unauthorized access.

Compensating Controls: If patching is delayed, isolate the GV-I/O Box 4E on a restricted VLAN and block external access to port 10001 at the network perimeter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the maximum severity score and the lack of authentication required to trigger this vulnerability, immediate remediation is mandatory. System administrators should prioritize firmware updates or network-level isolation to prevent unauthorized access to these embedded devices.