GeoWebPlayer (version 1.1.1.0) includes a websocket server that accepts commands from localhost, including 'connectionInfo' which provides camera connection details. The handler for this command, handle_connection_info, copies JSON strings into fixed-size buffers using manual byte-by-byte loops without enforcing length limits. This results in a classic buffer overflow (CWE-120) in the username field, allowing an attacker to overflow buffers with crafted input. The vulnerability has a CVSS 3.1 score of 8.3, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, which may allow an attacker to execute arbitrary code, cause denial of service, or otherwise compromise the affected system. The CVSS score indicates high impact on confidentiality, integrity, and availability. The vulnerability affects the local websocket server component of GeoWebPlayer, potentially impacting the security of camera connection information and related services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost websocket server to trusted users only and monitor for suspicious activity. Avoid running GeoWebPlayer version 1.1.1.0 in untrusted environments. Follow vendor communications for updates on patches or official mitigations.