GeoWebPlayer (also known as Web Plugin or WS Player) includes a websocket server that processes commands from localhost. The 'handle_connection_info' function, which processes the 'connectionInfo' command, performs multiple string copy operations using manual byte-by-byte loops without enforcing length limits. This results in a buffer overflow vulnerability (CWE-120) in the username field when processing attacker-controlled JSON input. The vulnerability is present in version 1.1.1.0 of GeoWebPlayer. The CVSS 3.1 base score is 8.3, reflecting network attack vector with high complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability with scope changed.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, potentially allowing an attacker to execute arbitrary code, cause denial of service, or compromise the confidentiality and integrity of the affected system. The vulnerability affects the websocket server component that is critical for the operation of GeoVision's web interfaces, thus impacting the availability and security of connected camera systems.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the localhost interface where the websocket server listens, and monitor for unusual activity related to the GeoWebPlayer websocket server. Avoid exposing the vulnerable component to untrusted users or networks.