CVE-2026-42370
Published: 04 May 2026
Summary
CVE-2026-42370 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Geovision Gv-Vms Firmware. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A stack overflow vulnerability, tracked as CVE-2026-42370 and published on 2026-05-04, affects the WebCam Server Login functionality in GeoVision GV-VMS V20 version 20.0.2. This flaw, classified under CWE-787 (Out-of-bounds Write), allows a specially crafted HTTP request to trigger a stack overflow, potentially leading to arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, changed scope, and high impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this vulnerability remotely over the network by sending a malicious HTTP request to the affected WebCam Server Login endpoint. Successful exploitation requires high attack complexity but no user interaction or privileges, enabling the attacker to achieve arbitrary code execution on the target system. This could allow full compromise of the GV-VMS server, potentially leading to unauthorized access, data theft, or further lateral movement within the victim's environment.
For mitigation details, security practitioners should consult the primary advisories from Talos Intelligence at https://talosintelligence.com/vulnerability_reports/ and GeoVision's cyber security page at https://www.geovision.com.tw/cyber_security.php, which may provide patch information, workarounds, or updated versions of GV-VMS.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26861
Vulnerability details
A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack overflow in public-facing WebCam Server Login endpoint directly enables T1190 (Exploit Public-Facing Application) for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identifying, reporting, and correcting system flaws like this stack overflow vulnerability through timely patching, directly eliminating the CVE.
SI-10 mandates validating HTTP inputs to the WebCam Server Login endpoint, preventing specially crafted requests from triggering the stack overflow.
SI-16 implements memory safeguards such as stack canaries and ASLR to protect against exploitation of the stack overflow leading to arbitrary code execution.