Kelly Patterson

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, specifically affecting the key field, which can lead to a buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the `setPIP` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated function `handle connection info` contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the username field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer addon, which creates a websocket server to expand web-interface capabilities for GeoVision software, contains a memory corruption issue. The `handle connection info` function fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This occurs specifically when processing the `connectionInfo` command, particularly within the password field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated `handle connection info()` function contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the `ip` field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the disconnect command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software such as GV-VMS and GV-Cloud. It establishes a websocket server to enhance the functionality of web interfaces. The software contains an out-of-bounds read issue triggered by the pause command index-out-of-bound. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command to provide camera connection details, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, potentially leading to a buffer overflow, specifically within the password field when no key is present. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This can lead to a buffer overflow, specifically when processing the `username` field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `2wayAudio` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the play command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the snapshot command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that implements a websocket server to extend web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. A lack of range validation for the `index` parameter allows out-of-bounds access to multiple arrays. Specifically, when the `saveVideo` command is used, the `index` value is used to trigger and release a CriticalSection (a synchronization mechanism used to prevent multiple threads from accessing a shared resource simultaneously). The release process involves a function pointer read from an out-of-bounds memory location, which could potentially lead to arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `setStream` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the audio command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer addon, which functions as a websocket server for GeoVision software such as GV-VMS and GV-Cloud, contains an out-of-bounds array access flaw. The server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not properly validated for range, it can be used to access arrays outside their intended boundaries, specifically within the `connectInfo` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer version 1.1.1.0 **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server does not require authentication, allowing malicious websites to establish connections and access sensitive APIs. An attacker can use a combination of the `create` method and the `getScreenCapture` method to capture and retrieve the content of the user's screen. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-I/O Box 4E (affected versions not specified) **Description** The DVRSearch service, which runs by default and listens for UDP messages on port 10001, contains a stack-based buffer overflow. The issue occurs when the server processes unauthenticated network messages and uses an attacker-controlled `net mask` length in a `memcpy()` function to copy data into a fixed-size reply buffer without proper bounds checking. This can be exploited remotely to achieve remote code execution and full device compromise. **Recommendations** Disable or block UDP port 10001 at the network perimeter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-VMS V20 version 20.0.2 **Description** Memory corruption occurs within the GV-Cloud functionality. A remote attacker can trigger a denial of service by sending a specially crafted network request while impersonating the legitimate server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.