CVE-2026-42370 is a stack overflow in the WebCam Server login function of GeoVision GV-VMS V20 version 20.0.2, scored CVSS 9.0 (critical). A specially crafted HTTP request from an unauthenticated attacker can lead to code execution. Check the GeoVision security page for the corrected release.
What's affected
The NVD record names GeoVision GV-VMS V20 version 20.0.2, with the WebCam Server login functionality as the affected component. It also lists the GV-VMS firmware product.
The record does not state a fixed version. Talos describes the issue in report TALOS-2026-2369 and GeoVision keeps its notices on its cyber security page. I could not confirm a fixed build from either, so read the vendor page rather than relying on a number from a third party.
The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:C. That means network reachable, no login needed, high attack complexity, and impact beyond the component itself.
How to check if you're exposed
- Open the GV-VMS software and read the version from its about screen, or from your deployment records. Version 20.0.2 is named in the record.
- Find out whether the WebCam Server feature is turned on and which port it listens on.
- Check from outside your network, or from a scanner you trust, whether that port is reachable from the internet or from untrusted network segments.
- Compare your build with the fixed release on the GeoVision cyber security page.
Video management servers are often left reachable for remote viewing, so the exposure check matters as much as the version check.
What to do now
- Read the GeoVision cyber security notice for this issue and note the fixed release.
- Update GV-VMS to the fixed release as soon as it is available to you.
- Until then, block access to the WebCam Server login from the internet and from untrusted networks. Put it behind a VPN or an allow list.
- Look at the host running GV-VMS for unexpected processes, new accounts and outbound connections.
- Record the version in your asset inventory so future advisories are quick to match.
Why it matters
The weakness is CWE-787, an out of bounds write. A stack overflow lets input overwrite memory next to a buffer, and in the worst case an attacker steers execution. The record says an unauthenticated HTTP request can trigger it, which is why the score is critical even though attack complexity is rated high.
Surveillance servers hold video and often sit on networks with other sensitive systems. A compromised host can become a foothold. The KEV flag in the record is false, and I found no statement of exploitation in the wild.
Quick check
Is there a confirmed fixed version?
Not in the sources I could read. The NVD record names version 20.0.2 as affected and points to GeoVision. Confirm the fix on the vendor page.
Sources
- Cisco Talos report TALOS-2026-2369 (listed in the NVD record, not retrieved)
- GeoVision cyber security page (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
