CVE-2026-42370

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
GeoVision Inc.	GV-VMS V20.0.2	20.0.2

References

https://talosintelligence.com/vulnerability_reports/Third Party Advisory
https://www.geovision.com.tw/cyber_security.phpVendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2369

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-423715.1uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.CVE-2026-423728.8D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via CVE-2026-423738.8D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via CVE-2026-423748.8D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/CVE-2026-423758.8D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/CVE-2026-423769.8D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via CVE-2026-423777.3Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Level CVE-2026-423786.5Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.CVE-2026-423797.7Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue CVE-2026-42384.7A vulnerability has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/CVE-2026-423809.8Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.CVE-2026-423819.3Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.