CVE-2026-42370

critical · 9

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

CVSS

0.5%

EPSS (exploit prob.)

45th

EPSS percentile

2026-05-04

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
geovision	gv-vms_firmware	< 21.0.0
geovision	gv-vms	20

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/
https://www.geovision.com.tw/cyber_security.php
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2369

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-42370