Executive brief
GeoWebPlayer is a software component used with GeoVision video management systems to enable web-based video playback. A security vulnerability in this component allows an attacker to potentially take control of a user's computer if the user visits a malicious website. This could lead to unauthorized access to surveillance data or the compromise of the workstation running the GeoVision software.
Technical details
GeoVision GeoWebPlayer (v1.1.1.0) contains multiple improper validation of array index vulnerabilities (CWE-129) within its WebSocket server. The server accepts commands (such as connectInfo, setStream, and disconnect) from localhost that include an 'index' parameter. Because this index is not range-checked before being used to access internal arrays and critical sections, an attacker can trigger out-of-bounds reads or writes. By enticing a user to visit a malicious webpage, the attacker can send specially crafted WebSocket messages to the local server to overwrite memory or redirect execution flow via function pointers, leading to arbitrary code execution. The vulnerability is addressed in version 1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer 1.1.1.0
Timeline
- 2026-07-01: disclosed: Initial disclosure by Cisco Talos
- 2026-07-02: advisory: NVD publication date
- 2026-07-02: patched: Vendor confirmed version 1.1.3.0 is unaffected