GeoWebPlayer, an addon for GeoVision software that provides a websocket server for enhanced web interface functionality, suffers from an improper validation of array index vulnerability (CWE-129). The websocket server processes commands from localhost that include an 'index' parameter used to access arrays without proper bounds checking. This allows out-of-bound access, potentially enabling attackers to manipulate critical sections and invoke unintended function calls. The vulnerability is identified in version 1.1.1.0 of GeoWebPlayer. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with local access to the websocket server to perform out-of-bound array accesses. This may lead to unauthorized code execution, data corruption, or denial of service, impacting confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost websocket server to trusted users only and monitor for unusual activity. Avoid executing untrusted commands that include index parameters. Follow vendor updates closely for any forthcoming patches or mitigations.