CVE Explorer
CVE-2026-13125
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.
In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connecti
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","packageName":"GeoWebPlayer","platforms":["Windows","64 bit"],"product":"GeoWebPlayer","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"V1.1.1.0"},{"status":"unaffected","version":"V1.1.3.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:9948f5c3d66505c8ab64f0bfb81e9fe18ccecbac12f2d0e6aed6cf2aa8a6dc6f · sha256:06c2ea71d7ff0bf2… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:9948f5c3d66505c8ab64f0bfb81e9fe18ccecbac12f2d0e6aed6cf2aa8a6dc6f · sha256:06c2ea71d7ff0bf2… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-306","description":"CWE-306 Missing authentication for critical function","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9948f5c3d66505c8ab64f0bfb81e9fe18ccecbac12f2d0e6aed6cf2aa8a6dc6f · sha256:06c2ea71d7ff0bf2… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"https://www.geovision.com.tw/cyber_security.php"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9948f5c3d66505c8ab64f0bfb81e9fe18ccecbac12f2d0e6aed6cf2aa8a6dc6f · sha256:06c2ea71d7ff0bf2… · /containers/cna/references/0
{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2370"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9948f5c3d66505c8ab64f0bfb81e9fe18ccecbac12f2d0e6aed6cf2aa8a6dc6f · sha256:06c2ea71d7ff0bf2… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.