Executive brief
GeoWebPlayer is a browser-based plugin used to view video streams from GeoVision surveillance systems. A security flaw allows an attacker to potentially take control of a user's computer if the user visits a malicious website while the plugin is active. This could lead to unauthorized access to the surveillance system or the underlying workstation.
Technical details
An improper validation of array index (CWE-129) exists in the WebSocket server functionality of GeoVision GeoWebPlayer version 1.1.1.0. The vulnerability occurs when processing the 'pause' command (and other similar commands like connectInfo and setStream), where an 'index' field is extracted from a JSON-formatted WebSocket message and used to access internal arrays without proper bounds checking. By providing a specially crafted index value, an attacker can trigger an out-of-bounds read or write, potentially leading to the execution of arbitrary code via corrupted function pointers. Exploitation requires the victim to visit a malicious website that communicates with the local WebSocket server. The issue is addressed in version V1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer V1.1.1.0
Timeline
- 2026-07-01: disclosed: Talos published vulnerability report TALOS-2026-2373
- 2026-07-02: advisory: CVE-2026-57271 published by GeoVision
- 2026-07-02: patched: Version V1.1.3.0 confirmed as unaffected/patched