Is CVE-2026-13125 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13125 being exploited in the wild.

How severe is CVE-2026-13125?

High severity, with a CVSS score of 8.8, published 2 July 2026.

Which products and versions are affected?

Geovision GeoWebPlayer V1.1.1.0.

Is there a fix for CVE-2026-13125?

A patch was published on 2026-04-28: Vendor patch release (V1.1.3.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13125 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13125?

Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13125: GeoVision GeoWebPlayer authentication bypass in WebSocket server

CVE-2026-13125 · Severity: high · CVSS 8.8 · Published 2026-07-02

GeoWebPlayer, a component used with GeoVision video management software to enable web-based viewing, contains a security flaw that allows unauthorized access to its internal communication server. By tricking a user into visiting a malicious website, an attacker can remotely capture and view the user's screen. This could lead to the theft of sensitive information displayed on the monitor or the compromise of private video surveillance feeds.

Technologies: Geovision GeoWebPlayer. Vendors: Geovision.

Quick answers

Is CVE-2026-13125 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13125 being exploited in the wild.
How severe is CVE-2026-13125?: High severity, with a CVSS score of 8.8, published 2 July 2026.
Which products and versions are affected?: Geovision GeoWebPlayer V1.1.1.0.
Is there a fix for CVE-2026-13125?: A patch was published on 2026-04-28: Vendor patch release (V1.1.3.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13125 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13125?: Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the WebSocket server functionality of GeoVision GeoWebPlayer (also known as Web Plugin or WS Player). The server, which typically listens on localhost:9100, does not require authentication for incoming connections. A remote attacker can exploit this by hosting a malicious webpage that, when visited by a user with the plugin installed, initiates a WebSocket connection to the local server. By calling a sequence of the 'create' and 'getScreenCapture' methods, the attacker can bypass Same-Origin Policy (SOP) protections and exfiltrate real-time screenshots of the user's desktop. The vulnerability is fixed in version V1.1.3.0.

Affected products

GeoVision Inc. GeoWebPlayer (Web Plugin / WS Player) V1.1.1.0

Timeline

2026-03-25: other: Initial vendor contact
2026-04-21: disclosed: Vendor disclosure
2026-04-28: patched: Vendor patch release (V1.1.3.0)
2026-07-01: advisory: Public release by Cisco Talos
2026-07-02: disclosed: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.