GeoVision GV-VMS V20.0.2 up to 20.0.2 WebCam Server Login out-of-bounds write

Summaryinfo

A vulnerability was found in GeoVision GV-VMS V20.0.2 up to 20.0.2. It has been rated as critical. The affected element is an unknown function of the component WebCam Server Login. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-7372. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in GeoVision GV-VMS V20.0.2 up to 20.0.2. This affects an unknown function of the component WebCam Server Login. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. #### Stack-overflow via unconstrained sscanf The call to `sscanf` at [1] to split the `Buffer` variable into the `username` and `password` variables doesn't limit the size of the extracted content to match the destination buffers' sizes. In this case, if either the username or password decoded from the authorization string exceeds `40` characters (the size the stack variables `username` and `password`) then a stack overflow will occur. The data is controlled by an attacker, but sronger constraints (e.g. no null bytes) may make exploitation harder. A successful attack could lead to full code execution as SYSTEM on the machine running the service.

The weakness was disclosed by Philippe Laulheret. It is possible to read the advisory at geovision.com.tw. This vulnerability is uniquely identified as CVE-2026-7372 since 04/29/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/04/2026).

Upgrading to version 21.0.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• GeoVision

Name

• GV-VMS V20.0.2

Version

• 20.0.0
• 20.0.1
• 20.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion