CVE-2026-42370: Geovision GV-VMS Firmware RCE Vulnerability

CVE-2026-42370 Overview

CVE-2026-42370 is a stack overflow vulnerability in the WebCam Server Login functionality of GeoVision GV-VMS V20 version 20.0.2. A specially crafted HTTP request triggers memory corruption that leads to arbitrary code execution. The flaw is reachable without authentication, allowing remote attackers to compromise affected video management systems over the network.

The vulnerability is classified under CWE-787 (Out-of-Bounds Write) and affects deployments of GeoVision GV-VMS used to manage IP cameras and surveillance infrastructure. Successful exploitation grants attackers full control over the underlying host running the video management server.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on GeoVision GV-VMS V20 20.0.2 servers by sending a single malformed HTTP login request.

Affected Products

• GeoVision GV-VMS V20 version 20.0.2
• GeoVision GV-VMS firmware (vulnerable builds)
• Surveillance deployments exposing the WebCam Server login endpoint

Discovery Timeline

• 2026-05-04 - CVE-2026-42370 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-42370

Vulnerability Analysis

The vulnerability resides in the WebCam Server Login handler of GeoVision GV-VMS V20 20.0.2. The login routine processes attacker-supplied data from HTTP request fields without enforcing proper bounds on the destination buffer. When the input exceeds the expected size, the routine writes past the end of a stack-allocated buffer.

This stack-based out-of-bounds write corrupts adjacent stack memory, including saved return addresses and frame pointers. Attackers leverage the corruption to redirect execution flow into attacker-controlled code. The pre-authentication nature of the login endpoint means no credentials or prior access are required to reach the vulnerable code path.

Root Cause

The root cause is missing input length validation in the login request parser, mapped to [CWE-787]. The handler trusts the size of incoming HTTP fields and copies them into a fixed-size stack buffer using an unsafe memory operation. Without a length check or use of bounds-aware copy primitives, oversized fields overflow the buffer and overwrite control data on the stack.

Attack Vector

Exploitation occurs over the network against the HTTP service exposed by the GV-VMS WebCam Server. An attacker sends a crafted HTTP login request containing oversized payload data targeting the vulnerable parameter. No authentication, user interaction, or specific environmental conditions are required.

Because GV-VMS deployments commonly serve as central recorders for IP camera fleets, exploited servers can be used to pivot into surveillance footage, network camera feeds, and adjacent enterprise networks. Refer to the Talos Intelligence Vulnerability Reports for additional technical detail on the affected code path.

Detection Methods for CVE-2026-42370

Indicators of Compromise

• HTTP POST requests to the GV-VMS WebCam Server login endpoint containing abnormally long field values or non-printable bytes in credential parameters.
• Unexpected child processes spawned by the GV-VMS server process, or new outbound connections from the VMS host to unfamiliar IP addresses.
• Crash artifacts, service restarts, or stack trace entries referencing the WebCam Server login handler.

Detection Strategies

• Inspect HTTP traffic to the GV-VMS management interface for login requests exceeding expected parameter lengths and block or alert on anomalies at the network perimeter.
• Monitor the GV-VMS host for process integrity violations, unexpected memory regions marked executable, and shellcode-like behavior originating from the server binary.
• Correlate authentication failures, service crashes, and outbound connections from the VMS server within a short time window to surface exploitation attempts.

Monitoring Recommendations

• Forward GV-VMS application logs, Windows Event Logs, and network flow data to a centralized analytics platform for correlation and retention.
• Alert on any inbound connections to the WebCam Server login port from networks that should not have administrative access to surveillance infrastructure.
• Track service availability and crash counters for the GV-VMS process to identify reliability anomalies that may indicate failed exploit attempts.

How to Mitigate CVE-2026-42370

Immediate Actions Required

• Restrict network access to the GV-VMS WebCam Server login endpoint using firewall rules so that only trusted management subnets can reach it.
• Remove direct internet exposure of GV-VMS hosts and place them behind a VPN or jump host until a fixed firmware build is applied.
• Inventory GeoVision GV-VMS deployments to identify systems running version 20.0.2 and prioritize them for remediation.

Patch Information

Consult the GeoVision Cyber Security Overview for vendor advisories and updated firmware addressing CVE-2026-42370. Apply the vendor-supplied patch to all affected GV-VMS V20 20.0.2 installations as soon as it is available, and verify the running version after upgrade.

Workarounds

• Segment the surveillance network from corporate and internet-facing networks to limit reachability of the vulnerable HTTP service.
• Place a reverse proxy or web application firewall in front of the GV-VMS login endpoint to enforce request size limits and reject oversized parameters.
• Disable remote administrative access to the WebCam Server when not actively required for operations.

# Example: restrict GV-VMS HTTP access to a management subnet on Windows
netsh advfirewall firewall add rule name="GV-VMS Mgmt Only" \
    dir=in action=allow protocol=TCP localport=80,443 \
    remoteip=10.10.50.0/24

netsh advfirewall firewall add rule name="Block GV-VMS Public" \
    dir=in action=block protocol=TCP localport=80,443