CVE-2026-57272

{"id": "CVE-2026-57272", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57272", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T12:38:30.227626Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "affectedData": [{"vendor": "GeoVision Inc.", "product": "GeoWebPlayer", "versions": [{"status": "affected", "version": "V1.1.1.0"}, {"status": "unaffected", "version": "V1.1.3.0"}], "platforms": ["Windows", "64 bit"], "packageName": "GeoWebPlayer", "defaultStatus": "unaffected"}]}], "published": "2026-07-02T04:17:13.423", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}, {"url": "https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nThe Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.\n\n\n\n#### byPass command index-out-of-bound"}, {"lang": "es", "value": "GeoWebPlayer (tambi\u00e9n llamado \u2019Web Plugin\u2019 en la documentaci\u00f3n de GV-VMS y \u2019WS Player\u2019 para VMS-Cloud) es un complemento que se puede instalar con varios software de GeoVision (GV-VMS, GV-Cloud, ...). Crea un servidor websocket que expande las capacidades de las diversas interfaces web proporcionadas por el software de GeoVision y puede ser necesario para que funcionen correctamente.\n\nEl servidor Websocket puede aceptar varios comandos provenientes de localhost. Muchos de los comandos tomar\u00e1n un valor \u201cindex\u201d que luego se utiliza para acceder a varios arrays para entrar en secciones cr\u00edticas, realizar varias acciones a trav\u00e9s de llamadas a funciones, etc. Sin embargo, el valor \u201cindex\u201d normalmente no se verifica para un rango v\u00e1lido, y como tal, puede ser utilizado para acceder a m\u00faltiples arrays fuera de los l\u00edmites.\n\n#### omisi\u00f3n de comando \u00edndice-fuera-de-l\u00edmites"}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9"}