What is the CVSS score of CVE-2026-13125?

CVE-2026-13125 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-13125?

GeoVision's GeoWebPlayer addon (branded as 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) contains an authentication bypass flaw that allows attackers to exfiltrate a user's screen contents by…

How to fix or mitigate CVE-2026-13125?

Within 24 hours: Audit internal deployments of GeoVision products (GV-VMS, VMS-Cloud) and inventory affected user endpoints. Notify end-users of the risk and advise against using the affected plugin pending a patch. Within 7 days: Disable or uninstall the plugin on non-critical systems; implement firewall rules blocking local WebSocket access from browsers (localhost:*, 127.0.0.1:*) where feasible; deploy Content Security Policy headers restricting cross-origin WebSocket connections. Within 30 days: Monitor GeoVision advisories for patch release; evaluate alternative vendor solutions if patching is delayed beyond 60 days.

GeoVision GeoWebPlayer CVE-2026-13125

EUVD-2026-41241 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-02 GV

GHSA-8728-ccm5-wcj7

Authentication Bypass Geowebplayer Geovision Inc

8.8

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

vuln.today AI

8.8 HIGH

Browser-reachable unauthenticated WebSocket (AV:N/PR:N/AC:L) needs the victim to open a page (UI:R); it crosses from the addon into user data (S:C) exposing screen contents (C:H) with limited API side effects (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:46 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it's possible to call a combination of the create method and getScreenCapture to retrieve the content of the user's screen.

AnalysisAI

Missing authentication in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets any web page reach a locally-bound, unauthenticated WebSocket server and invoke sensitive APIs. By chaining the create method with getScreenCapture, a remote attacker who lures a victim to a malicious site can silently exfiltrate the contents of the user's screen. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; CVSS is 8.8 driven by network reach and a scope change into the browsing user's data.

Technical ContextAI

GeoWebPlayer is a companion component installed alongside GeoVision surveillance/VMS products (GV-VMS, GV-Cloud) that stands up a local WebSocket server to extend the vendor's web interfaces. The root cause is CWE-306 (Missing Authentication for a Critical Function): the WebSocket endpoint accepts connections without any credential or origin/authentication check, so trust is implicitly granted to any origin the browser will let connect. Because browsers permit cross-origin WebSocket handshakes and the server performs no auth or origin allow-listing, any website loaded in the victim's browser can drive the exposed method surface - here, a create call followed by getScreenCapture that returns rendered screen content. The single CPE in scope is cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, with no version boundaries enumerated.

RemediationAI

No vendor-released patch version is identified in the available data; consult the GeoVision security portal at https://www.geovision.com.tw/cyber_security.php for an advisory and updated GeoWebPlayer/Web Plugin/WS Player build, and apply the fixed version once published. As compensating controls until then: uninstall or stop the GeoWebPlayer/Web Plugin addon on workstations that do not require the web interface (trade-off: GeoVision web UIs relying on the WebSocket bridge may lose functionality); restrict outbound web browsing on hosts that run the plugin, or isolate those hosts from general internet access so a malicious page cannot reach the local server (trade-off: reduced usability on operator machines); and where a host firewall permits, block untrusted processes/origins from reaching the local WebSocket listener port. These reduce the attack surface at the cost of the addon's convenience features.