PT-2026-36741 · Geovision · Gv-Vms V20

Kelly Patterson + 2 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7372

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoVision GV-VMS V20 version 20.0.2

Description A stack overflow exists in the WebCam Server Login functionality. An unauthenticated attacker can send a specially crafted HTTP request to trigger the issue, potentially leading to arbitrary code execution with SYSTEM privileges. The flaw occurs because the sscanf() function is used to split the Buffer variable into username and password variables without limiting the size of the extracted content. If either the username or password decoded from the authorization string exceeds 40 characters, a stack overflow occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-7372

Affected Products

Gv-Vms V20

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7372 · Security Note
• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2051124595726352724 · Twitter Post
• https://talosintelligence.com/vulnerability_reports · Note
• https://reddit.com/r/pwnhub/comments/1t3in25/critical_rce_vulnerability_discovered_in · Reddit Post