PT-2026-36737 · Unknown · Gv-Vms V20

Kelly Patterson + 2 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-42369

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GV-VMS V20

Description The WebCam Server feature in GV-VMS allows remote access to management and monitoring via a web interface. The gvapi endpoint utilizes a custom authentication mechanism supporting Basic and Digest modes. A stack overflow occurs when the b64decoder string is copied to the Buffer stack variable without bound-checking; if the decoded string exceeds 256 characters, it overflows the buffer. Since the web server is compiled without Address Space Layout Randomization (ASLR)—a security technique that randomly arranges address spaces of key data areas to prevent memory corruption attacks—an attacker can control the data to achieve full code execution with SYSTEM privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-42369

Affected Products

Gv-Vms V20

References · 5

• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42369 · Security Note
• https://twitter.com/vuldb/status/2051163207415513132 · Twitter Post
• https://https//talosintelligence.com/vulnerability_reports · Note
• https://twitter.com/VulmonFeeds/status/2051129715356782611 · Twitter Post