Executive brief
GeoWebPlayer, a browser plugin used with GeoVision video management software to enable web-based camera viewing, contains a security flaw in how it handles internal commands. An attacker could trick a user into visiting a malicious website that sends specially crafted messages to the plugin, potentially allowing the attacker to take control of the user's computer. This could lead to unauthorized access to surveillance video, data theft, or a complete system compromise.
Technical details
GeoVision GeoWebPlayer (v1.1.1.0) contains multiple out-of-bounds read and write vulnerabilities within its WebSocket server functionality. The root cause is the lack of range validation for the 'index' parameter provided in commands such as 'play', 'connectInfo', and 'setStream'. This index is used to access arrays of critical sections and camera objects; an attacker can provide an out-of-bounds index to manipulate memory or trigger function calls via corrupted function pointers. The attack vector requires a victim to visit a malicious webpage (User Interaction) which then communicates with the local WebSocket server (typically on localhost). Successful exploitation can result in arbitrary code execution (ACE) with the privileges of the plugin. The vulnerability is addressed in version V1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer V1.1.1.0
Timeline
- 2026-07-01: disclosed: Talos Intelligence published advisory TALOS-2026-2373
- 2026-07-02: advisory: CVE-2026-57270 published in NVD
- 2026-07-02: patched: Vendor confirmed V1.1.3.0 is unaffected