Executive brief
GeoWebPlayer is a browser-based plugin used to view video feeds from GeoVision surveillance systems. A security flaw in how the plugin handles connection requests could allow an attacker to take control of a user's computer if they visit a malicious website. This could lead to unauthorized access to video feeds, data theft, or a complete system compromise.
Technical details
A stack-based buffer overflow exists in GeoVision GeoWebPlayer version 1.1.1.0 within the WebSocket server component. The vulnerability is located in the `handle_connection_info` function, which processes the `connectionInfo` command. When a 'key' variable is provided in the JSON payload, the application copies the 'password' field into a fixed-size 128-byte buffer (`password_enc`) using a manual byte-by-byte loop without bounds checking. An attacker can exploit this by hosting a malicious webpage that sends a specially crafted WebSocket message to the local GeoWebPlayer service, leading to arbitrary code execution. The vendor has released version 1.1.3.0 to address this issue.
Affected products
- GeoVision Inc. GeoWebPlayer 1.1.1.0
Timeline
- 2026-03-25: other: Initial vendor contact
- 2026-04-21: disclosed: Vendor disclosure
- 2026-04-28: patched: Vendor patch release (v1.1.3.0)
- 2026-07-01: advisory: Public release by Cisco Talos
- 2026-07-02: advisory: NVD publication