GeoWebPlayer (also known as Web Plugin or WS Player) is an addon for GeoVision software that provides a websocket server to extend web interface capabilities. The server processes commands from localhost that include an 'index' parameter used to access arrays. Due to lack of proper bounds checking on this index, an attacker with local access can cause out-of-bounds array access, potentially leading to critical security impacts. The vulnerability is identified as CWE-129 (Improper Validation of Array Index) and affects GeoWebPlayer version 1.1.1.0. The CVSS v3.1 score is 8.3 (high), indicating network attack vector with high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to unauthorized access or manipulation of memory outside intended bounds, potentially resulting in system compromise, data corruption, or denial of service. The CVSS score of 8.3 reflects high impact on confidentiality, integrity, and availability. The vulnerability requires network access but with high attack complexity and user interaction, and it affects the local websocket server component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost websocket server to trusted users only and monitor for suspicious local activity. Avoid executing untrusted commands that include index parameters. Follow vendor communications for updates on patches or mitigations.