CVE-2026-57270

{"id": "CVE-2026-57270", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57270", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T12:40:04.722639Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "affectedData": [{"vendor": "GeoVision Inc.", "product": "GeoWebPlayer", "versions": [{"status": "affected", "version": "V1.1.1.0"}, {"status": "unaffected", "version": "V1.1.3.0"}], "platforms": ["Windows", "64 bit"], "packageName": "GeoWebPlayer", "defaultStatus": "unaffected"}]}], "published": "2026-07-02T04:17:13.103", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}, {"url": "https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nThe Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.\n\n\n\n#### play command index-out-of-bound"}, {"lang": "es", "value": "GeoWebPlayer (tambi\u00e9n llamado \u2019Web Plugin\u2019 en la documentaci\u00f3n de GV-VMS y \u2019WS Player\u2019 para VMS-Cloud) es un complemento que se puede instalar con varios software de GeoVision (GV-VMS, GV-Cloud, ...). Crea un servidor websocket que expande las capacidades de las diversas interfaces web proporcionadas por el software de GeoVision y puede ser necesario para que funcionen correctamente.\n\nEl servidor Websocket puede aceptar varios comandos provenientes de localhost. Muchos de los comandos tomar\u00e1n un valor de \u00edndice que luego se utiliza para acceder a varias matrices para entrar en secciones cr\u00edticas, realizar varias acciones mediante llamadas a funciones, etc. Sin embargo, el valor de \u00edndice normalmente no se verifica su rango de validez, y como tal, puede ser utilizado para acceder a m\u00faltiples matrices fuera de los l\u00edmites.\n\n#### comando play con \u00edndice fuera de los l\u00edmites"}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9"}