Philippe Laulheret

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command to provide camera connection details, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, potentially leading to a buffer overflow, specifically within the password field when no key is present. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `2wayAudio` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software such as GV-VMS and GV-Cloud. It establishes a websocket server to enhance the functionality of web interfaces. The software contains an out-of-bounds read issue triggered by the pause command index-out-of-bound. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated function `handle connection info` contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the username field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer addon, which creates a websocket server to expand web-interface capabilities for GeoVision software, contains a memory corruption issue. The `handle connection info` function fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This occurs specifically when processing the `connectionInfo` command, particularly within the password field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated `handle connection info()` function contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the `ip` field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that implements a websocket server to extend web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. A lack of range validation for the `index` parameter allows out-of-bounds access to multiple arrays. Specifically, when the `saveVideo` command is used, the `index` value is used to trigger and release a CriticalSection (a synchronization mechanism used to prevent multiple threads from accessing a shared resource simultaneously). The release process involves a function pointer read from an out-of-bounds memory location, which could potentially lead to arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the `setPIP` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the snapshot command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the play command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This can lead to a buffer overflow, specifically when processing the `username` field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the disconnect command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, specifically affecting the key field, which can lead to a buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer version 1.1.1.0 **Description** GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server does not require authentication, allowing malicious websites to establish connections and access sensitive APIs. An attacker can use a combination of the `create` method and the `getScreenCapture` method to capture and retrieve the content of the user's screen. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the audio command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** The GeoWebPlayer addon, which functions as a websocket server for GeoVision software such as GV-VMS and GV-Cloud, contains an out-of-bounds array access flaw. The server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not properly validated for range, it can be used to access arrays outside their intended boundaries, specifically within the `connectInfo` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoWebPlayer (affected versions not specified) **Description** GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `setStream` command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-I/O Box 4E (affected versions not specified) **Description** The DVRSearch service, which runs by default and listens for UDP messages on port 10001, contains a stack-based buffer overflow. The issue occurs when the server reads up to 1460 bytes into a local buffer and subsequently performs an unsafe copy of the configured DNS address into a reply buffer using `memcpy()` with a length derived from `strlen()`. An unauthenticated network attacker can send crafted UDP traffic to trigger this overflow, potentially leading to remote code execution and full compromise of confidentiality, integrity, and availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-I/O Box 4E version 2.09 **Description** OS command injection flaws exist in the `libNetSetObj.so` internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially crafted network packet. Specifically, the `m F n Set Net Mask()` function fails to sanitize the `netmask addr` variable before passing it to a system call. This issue is reachable via the `Network.cgi` endpoint and the `DVRSearch` service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.