CVE-2026-42370

The vulnerability results from a stack overflow error (CWE-787) in the WebCam Server login handler module. The attacker sends a specially crafted HTTP request to the vulnerable endpoint, which causes a buffer overflow on the stack. This results in overwriting data that controls program execution, allowing the attacker to execute arbitrary code in the context of the server process. Exploitation requires no prior authentication or user interaction.

An attacker can gain the ability to execute arbitrary code on the device (RCE), which can lead to complete takeover of the video management system, loss of recording confidentiality, violation of system integrity, and its unavailability.

Apply patches available from the manufacturer according to the references. The manufacturer provides information about security updates at https://www.geovision.com.tw/cyber_security.php. Until patches are applied, it is recommended to restrict network access to the WebCam Server interface only to trusted IP addresses and to isolate GV-VMS devices in a separate network segment (VLAN) behind a firewall.

GeoVision GV-VMS V20, version 20.0.2 (GeoVision GV-VMS Firmware and GeoVision GV-VMS application)