Loading vulnerability…
GeoVision GV-VMS V20 WebCam Server Login Stack Overflow RCE
CVE-2026-42370 is a stack overflow vulnerability in the WebCam Server Login functionality of GeoVision GV-VMS V20 version 20.0.2. The flaw can be triggered by a specially crafted HTTP request sent to the exposed service, causing memory corruption in the login-handling code path. Successful exploitation may allow arbitrary code execution on the target system. Available reporting indicates the issue is remotely reachable over the network and does not require prior authentication or user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthenticated remote code execution on the affected GeoVision GV-VMS host. Given the assigned CVSS scope change and high confidentiality, integrity, and availability impacts, an attacker could potentially execute arbitrary code in the context of the vulnerable service, leading to full compromise of the application and possible broader compromise of the underlying system, including data exposure, tampering, and service disruption.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure of the WebCam Server interface by restricting network access to trusted management networks and authorized hosts only, removing direct internet exposure, and placing the service behind segmentation and access controls. Monitor for malformed or unexpected HTTP requests targeting the login functionality and consider temporary disablement of externally reachable WebCam Server features where operationally feasible. The available information does not provide a vendor-specific workaround.
Patch, then assume compromise.
Upgrade GeoVision GV-VMS V20 to a vendor-fixed release that addresses CVE-2026-42370. If a patched version is not yet deployed, prioritize vendor security updates for the affected 20.0.2 release and validate that the WebCam Server component is updated as part of the remediation process. The available information does not specify a precise fixed version beyond indicating that vendor patches were issued.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.