Back to overview

CVE-2018-25118

CRITICAL Exploitation: PoC
10.0
CVSS 4.0
Description
GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.

Metadata

CVE ID
CVE-2018-25118
State
PUBLISHED
Assigner
VulnCheck
Reserved
2025-10-20 17:58 UTC
Published
2025-10-20 21:14 UTC
Last updated
2026-04-07 14:03 UTC
Primary CWE
CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product
GeoVision Inc. / GV-BX1500
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (3)
VendorProductPlatformVersions
GeoVision Inc. GeoVision embedded IP devices — 0 < November/December 2017 firmware
GeoVision Inc. GV-BX1500 — 0 < November/December 2017 firmware
GeoVision Inc. GV-MFD1501 — 0 < November/December 2017 firmware
Weakness (CWE)
CWESourceDescription
CWE-78 cna CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References (5)
Back to overview