CVE-2026-42369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42369", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-04-26T23:39:08.350Z", "datePublished": "2026-05-04T00:47:00.507Z", "dateUpdated": "2026-05-15T07:45:15.385Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-05-15T07:45:15.385Z"}, "title": "GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability", "datePublic": "2026-04-27T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}, {"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-VMS V20.0.2", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "V20.0.2"}, {"status": "unaffected", "version": "V20.0.2.10"}, {"status": "unaffected", "version": "V20.1.0.0"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.0.2:*:windows:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.0.2.10:*:windows:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.1.0.0:*:windows:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the \"WebCam Server\" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. \n\n\n\nMost of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication.\u00a0\u00a0\n\n\n\n#### Stack-overflow via unbound copy of base64 decoded string\n\nThe `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by an attacker and lack of ASLR, this vulnerability can easily be exploited to gain full code execution as SYSTEM on the machine running the service.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the \"WebCam Server\" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. \n<br>\n<br>Most of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication.&nbsp;&nbsp;<div><br></div><div><br>#### Stack-overflow via unbound copy of base64 decoded string<br><br>The `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by an attacker and lack of ASLR, this vulnerability can easily be exploited to gain full code execution as SYSTEM on the machine running the service.</div>"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory", "third-party-advisory"]}, {"url": "https://https://talosintelligence.com/vulnerability_reports/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "GeoVision GV-VMS version V20.1.0 has patched the reported vulnerability.\u00a0\n\n\nUser is recommended to download the update from GeoVision's offical website\u00a0(https://www.geovision.com.tw/download/product/GV-VMS%20V20)\n\nor contact GeoVision Support team\n\n\n\n\nFor User currently running V20.0.2 may also visit the following link to download the V20.0.2.10\u00a0patch file that fixed the vulnerability.\u00a0\n\nhttps://php.gvdip.com/phpbb3/viewtopic.php?t=3326", "supportingMedia": [{"type": "text/html", "base64": false, "value": "GeoVision GV-VMS version V20.1.0 has patched the reported vulnerability.&nbsp;<div><br></div><div>User is recommended to download the update from GeoVision's offical website&nbsp;<span>(https://www.geovision.com.tw/download/product/GV-VMS%20V20)</span></div><div>or contact GeoVision Support team</div><div><br></div><div><div>For User currently running V20.0.2 may also visit the following link to download the V20.0.2.10&nbsp;patch file that fixed the vulnerability.&nbsp;</div><div>https://php.gvdip.com/phpbb3/viewtopic.php?t=3326</div></div>"}]}], "timeline": [{"time": "2026-02-17T01:32:00.000Z", "lang": "en", "value": "Initial Vendor Contact"}], "credits": [{"lang": "en", "value": "Philippe Laulheret of Cisco Talos.", "type": "finder"}, {"lang": "en", "value": "Kelly Patterson of Cisco Talos.", "type": "remediation reviewer"}, {"lang": "en", "value": "Martin Zeiser of Cisco Talos.", "type": "coordinator"}], "source": {"advisory": "TALOS-2026-2333", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-42369"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T03:56:13.979Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-04T12:51:31.572554Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T12:51:38.659Z"}}], "cna": {"title": "GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability", "source": {"advisory": "TALOS-2026-2333", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Philippe Laulheret of Cisco Talos."}, {"lang": "en", "type": "remediation reviewer", "value": "Kelly Patterson of Cisco Talos."}, {"lang": "en", "type": "coordinator", "value": "Martin Zeiser of Cisco Talos."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}, {"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-VMS V20.0.2", "versions": [{"status": "affected", "version": "V20.0.2"}, {"status": "unaffected", "version": "V20.0.2.10"}, {"status": "unaffected", "version": "V20.1.0.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-17T01:32:00.000Z", "value": "Initial Vendor Contact"}], "solutions": [{"lang": "en", "value": "GeoVision GV-VMS version V20.1.0 has patched the reported vulnerability.\u00a0\n\n\nUser is recommended to download the update from GeoVision's offical website\u00a0(https://www.geovision.com.tw/download/product/GV-VMS%20V20)\n\nor contact GeoVision Support team\n\n\n\n\nFor User currently running V20.0.2 may also visit the following link to download the V20.0.2.10\u00a0patch file that fixed the vulnerability.\u00a0\n\nhttps://php.gvdip.com/phpbb3/viewtopic.php?t=3326", "supportingMedia": [{"type": "text/html", "value": "GeoVision GV-VMS version V20.1.0 has patched the reported vulnerability.&nbsp;<div><br></div><div>User is recommended to download the update from GeoVision's offical website&nbsp;<span>(https://www.geovision.com.tw/download/product/GV-VMS%20V20)</span></div><div>or contact GeoVision Support team</div><div><br></div><div><div>For User currently running V20.0.2 may also visit the following link to download the V20.0.2.10&nbsp;patch file that fixed the vulnerability.&nbsp;</div><div>https://php.gvdip.com/phpbb3/viewtopic.php?t=3326</div></div>", "base64": false}]}], "datePublic": "2026-04-27T00:00:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory", "third-party-advisory"]}, {"url": "https://https://talosintelligence.com/vulnerability_reports/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the \"WebCam Server\" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. \n\n\n\nMost of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication.\u00a0\u00a0\n\n\n\n#### Stack-overflow via unbound copy of base64 decoded string\n\nThe `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by an attacker and lack of ASLR, this vulnerability can easily be exploited to gain full code execution as SYSTEM on the machine running the service.", "supportingMedia": [{"type": "text/html", "value": "GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the \"WebCam Server\" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. \n<br>\n<br>Most of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication.&nbsp;&nbsp;<div><br></div><div><br>#### Stack-overflow via unbound copy of base64 decoded string<br><br>The `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by an attacker and lack of ASLR, this vulnerability can easily be exploited to gain full code execution as SYSTEM on the machine running the service.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.0.2:*:windows:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.0.2.10:*:windows:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:geovision_inc.:gv-vms_v20.0.2:v20.1.0.0:*:windows:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-05-15T07:45:15.385Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42369", "state": "PUBLISHED", "dateUpdated": "2026-05-15T07:45:15.385Z", "dateReserved": "2026-04-26T23:39:08.350Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-05-04T00:47:00.507Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "GV-VMS V20.0.2", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "V20.0.2"}, {"status": "unaffected", "version": "V20.0.2.10"}, {"status": "unaffected", "version": "V20.1.0.0"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the \"WebCam Server\" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. \n\n\n\nMost of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication.\u00a0\u00a0\n\n\n\n#### Stack-overflow via unbound copy of base64 decoded string\n\nThe `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by an attacker and lack of ASLR, this vulnerability can easily be exploited to gain full code execution as SYSTEM on the machine running the service."}, {"lang": "es", "value": "GV-VMS V20 es un Software de Monitoreo de Video utilizado para recopilar las transmisiones de muchas c\u00e1maras de vigilancia y gestionar otros dispositivos de seguridad. Es una aplicaci\u00f3n nativa accedida localmente, pero tambi\u00e9n es posible habilitar el acceso remoto a trav\u00e9s de la caracter\u00edstica \u2019WebCam Server\u2019. Una vez habilitado, es posible acceder a la caracter\u00edstica de gesti\u00f3n y monitoreo a trav\u00e9s de una interfaz web regular. Este servidor web es otra aplicaci\u00f3n nativa, compilada sin ASLR, lo que hace que la explotaci\u00f3n sea mucho m\u00e1s f\u00e1cil y probable.\n\nLa mayor\u00eda de las caracter\u00edsticas requieren autenticaci\u00f3n antes de ser accesibles y aprovechan una p\u00e1gina de inicio de sesi\u00f3n est\u00e1ndar para conceder acceso. Sin embargo, el endpoint \u2019gvapi\u2019 utiliza su propio mecanismo de autenticaci\u00f3n a trav\u00e9s de un encabezado \u2019HTTP Authorization\u2019. Soporta tanto la autenticaci\u00f3n \u2019Basic\u2019 como los modos \u2019Digest\u2019 de autenticaci\u00f3n.\n\n#### Desbordamiento de pila mediante copia sin l\u00edmites de cadena decodificada en base64\n\nLa cadena \u2019b64decoder\u2019 tiene un tama\u00f1o din\u00e1mico, pero luego se copia a la variable de pila \u2019Buffer\u2019 un car\u00e1cter a la vez en [0], y no hay verificaci\u00f3n de l\u00edmites. Como tal, si la cadena decodificada es mayor de 256 caracteres (el tama\u00f1o de la variable \u2019Buffer\u2019), entonces ocurre un desbordamiento de pila. Debido a que los datos pueden ser completamente controlados por un atacante y la falta de ASLR, esta vulnerabilidad puede ser f\u00e1cilmente explotada para obtener ejecuci\u00f3n de c\u00f3digo completa como SYSTEM en la m\u00e1quina que ejecuta el servicio."}], "id": "CVE-2026-42369", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42369", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-04T01:16:04.153", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://https://talosintelligence.com/vulnerability_reports/"}, {"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[V20.0.2,V20.0.2]"}}, {"platform": ["windows"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[V21.0.0,V21.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "GV-VMS V20.0.2", "source": "cna", "vendor": "GeoVision Inc."}, "product": "gv-vms", "vendor": "geovision"}], "created": "2026-05-04T02:30:34.901139+00:00", "updated": "2026-05-04T19:44:17.578482+00:00", "vendors": ["geovision", "geovision$PRODUCT$gv-vms"]}