High severity · published Jul 2, 2026
CVE-2026-13125
GeoVision GeoWebPlayer 1.1.1.0 Websocket Server function vulnerability
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it's possible to call a combination of the `create` method and `getScreenCapture` to retrieve the content of the user's screen.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GeoWebPlayer · GeoVision Inc.
V1.1.1.0 · source: vendor
Affected product
GE
GeoWebPlayer
GeoVision Inc.
More from GeoWebPlayer
8.3
CVE-2026-57278
GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
8.3
CVE-2026-57277
GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
8.3
CVE-2026-57276
GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
8.3
CVE-2026-57275
GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
8.3
CVE-2026-57274
GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability