Back to overview

CVE-2026-13125

HIGH
8.8
CVSS 3.1
Description
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it's possible to call a combination of the `create` method and `getScreenCapture` to retrieve the content of the user's screen.

Metadata

CVE ID
CVE-2026-13125
State
PUBLISHED
Assigner
GV
Reserved
2026-06-24 00:32 UTC
Published
2026-07-02 02:14 UTC
Last updated
2026-07-02 03:08 UTC
Primary CWE
CWE-306
CWE-306 Missing authentication for critical function
Vendor / Product
GeoVision Inc. / GeoWebPlayer
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Affected products (1)
VendorProductPlatformVersions
GeoVision Inc. GeoWebPlayer Windows,64 bit V1.1.1.0, V1.1.3.0
Weakness (CWE)
CWESourceDescription
CWE-306 cna CWE-306 Missing authentication for critical function
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
References (1)
Back to overview