GeoWebPlayer (also known as Web Plugin or WS Player) is an addon for GeoVision software that provides a websocket server to extend web interface capabilities. The 'connectionInfo' command handler, handle_connection_info, copies JSON strings into fixed-size buffers using manual byte-by-byte loops without enforcing length limits. This leads to a classic buffer overflow (CWE-120) vulnerability, particularly in the password field, allowing potential remote code execution or denial of service. The affected version is exactly 1.1.1.0. The CVSS 3.1 score is 8.3 (high), with network attack vector, high complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, or denial of service. The vulnerability arises from improper bounds checking during string copy operations in the websocket server component, which can be triggered by sending crafted JSON input to the 'connectionInfo' command from localhost. This could allow an attacker to execute arbitrary code or crash the service.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict access to the localhost interface where the websocket server listens and limit user interaction to trusted parties only. Avoid running GeoWebPlayer version 1.1.1.0 in untrusted environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.