CVE-2026-42370

GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability

State: Published
Severity: 9.0 Critical
Published: May 4, 2026
Updated: Jun 15, 2026
Reserved: Apr 26, 2026

Description

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	GV

Weaknesses

CWE-787 Out-of-bounds write

Affected Products

Product	Versions
GV-VMS V20.0.2GeoVision Inc.	20.0.2Affected 20.0.2.10Not affected 20.1.0Not affected

References

https://www.geovision.com.tw/cyber_security.phpvendor-advisory
https://talosintelligence.com/vulnerability_reports/third-party-advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2369

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.