Executive brief
GeoWebPlayer is a browser-based video player used with GeoVision surveillance software to view camera feeds. A security flaw allows an attacker to execute malicious code on a user's computer if the user visits a specially crafted website while the plugin is active. This could lead to a full system compromise, unauthorized access to video feeds, or disruption of security monitoring operations.
Technical details
An improper validation of array index (CWE-129) exists in the WebSocket server component of GeoVision GeoWebPlayer version 1.1.1.0. When the server receives a 'saveVideo' command, it extracts an 'index' value from the JSON message and uses it to access the 'crit_sections' and 'array_of_IPCams' arrays without performing bounds checking. An attacker can provide an out-of-bounds index to trigger an out-of-bounds read of a function pointer during the release of a CriticalSection. By enticing a user to visit a malicious webpage that sends crafted WebSocket messages to localhost, an attacker can achieve arbitrary code execution. The vulnerability is addressed in version 1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer (Web Plugin / WS Player) 1.1.1.0
Timeline
- 2026-07-01: disclosed: Initial disclosure by Cisco Talos
- 2026-07-02: advisory: NVD publication date
- 2026-07-02: patched: Vendor confirmed version 1.1.3.0 is unaffected