Loading vulnerability…
Stack Overflow in GeoVision GV-VMS V20 WebCam Server Login
CVE-2026-7372 is a stack overflow vulnerability in the WebCam Server Login functionality of GeoVision GV-VMS V20 version 20.0.2. The flaw is caused by an unconstrained sscanf call that parses attacker-controlled credential data from an HTTP authorization string into fixed-size stack buffers used for the username and password. Because the parsed fields are not bounded to the 40-character size of the destination buffers, an overlong decoded username or password can overflow the stack. A remote unauthenticated attacker can trigger the condition by sending a specially crafted HTTP request. Successful exploitation can result in arbitrary code execution in the context of the affected service, which may run as SYSTEM.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to arbitrary code execution on the affected host. Because the vulnerable service may run with SYSTEM privileges, compromise can result in full control of the machine, including complete confidentiality, integrity, and availability impact. The published CVSS v3.1 vector indicates network reachability, no authentication requirement, no user interaction, and high impact across all three CIA dimensions.
If you can’t patch tonight, do this now.
Until patched, restrict network access to the WebCam Server Login interface to trusted management networks only and prevent exposure to untrusted or public networks. Place the service behind access controls such as VPNs, reverse proxies, or firewall rules, and disable the affected functionality if it is not required. Running the service with the least privileges possible can reduce post-exploitation impact, although it does not prevent the overflow itself. Monitoring for malformed or unusually long authorization data may help detect exploitation attempts.
Patch, then assume compromise.
Upgrade GeoVision GV-VMS V20 to a vendor-fixed release that addresses CVE-2026-7372. The vulnerable parsing logic must be corrected so that credential fields copied into stack buffers are length-bounded to the destination size, or replaced with safer parsing and validation routines. If a vendor patch is available through GeoVision security updates, it should be applied promptly to all affected deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.