The vulnerability in GeoVision GV-VMS V20.0.2 is caused by a stack overflow due to improper bounds checking in the sscanf call used to parse the username and password from an HTTP authorization string. The username and password buffers are limited to 40 characters, but the sscanf call does not enforce this limit, allowing an attacker to overflow the stack by providing longer input. This can result in arbitrary code execution with SYSTEM-level privileges. The vulnerability can be exploited via an unauthenticated HTTP request to the WebCam Server Login functionality. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the affected system with SYSTEM privileges, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system running GeoVision GV-VMS 20.0.2. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the WebCam Server Login interface to trusted users only and monitor for suspicious HTTP requests attempting to exploit this vulnerability. Avoid exposing the affected service directly to untrusted networks.