GeoVision GeoWebPlayer CVE-2026-13125

Exploitation requires that the GeoWebPlayer/Web Plugin/WS Player addon be installed and running (its WebSocket server active) on the victim's host, and that the victim open an attacker-controlled web page in a browser on that same host (UI:R). No authentication or credentials are needed against the WebSocket server itself (PR:N) because it enforces no authentication. Limiting factors: the attack depends on user interaction (visiting the malicious page), on the addon actually being installed and its server reachable from the browser, and on the browser permitting the cross-origin WebSocket connection; it does not grant code execution, and the demonstrated impact is confidentiality of screen contents rather than full host compromise.

Signals are moderately consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (the victim must open a malicious page) and crosses a scope boundary from the WebSocket component into the user's session data - a realistic model for a browser-driven screen-capture theft. There is no EPSS value, no CISA KEV listing, and no referenced proof-of-concept, so there is no evidence of active or automated exploitation; real-world urgency is tempered by the UI:R requirement and by the product's niche deployment. The one contradiction to flag: the vendor 'Tags' label this an 'Authentication Bypass,' but CWE-306 and the description describe missing authentication entirely rather than a bypass of an existing control - treat the mechanism as 'no auth required,' not 'auth circumvented.' Overall this is a credible confidentiality risk for organizations running GeoVision surveillance software on operator workstations, but absent EPSS/KEV/POC it is a patch-in-normal-cycle item rather than an emergency for most environments.

An attacker sends a surveillance operator a link (phishing email, chat, or malvertising) to a booby-trapped web page. When the operator opens it in a browser on the machine running GeoWebPlayer, background JavaScript opens an unauthenticated WebSocket to the local server, calls create and then getScreenCapture, and streams the victim's screen contents - potentially exposing live camera feeds, credentials, or other on-screen data - back to the attacker. No public exploit code is referenced, but the technique is straightforward given the missing authentication.