CVE-2026-13125 Overview
CVE-2026-13125 is a missing authentication vulnerability [CWE-306] in GeoVision GeoWebPlayer, an addon also referred to as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud. The component installs alongside GeoVision products such as GV-VMS and GV-Cloud and exposes a local WebSocket server that extends the vendor's web interfaces. The server accepts connections without authenticating the origin, allowing any website loaded in the victim's browser to invoke privileged APIs. An attacker can chain the create method with getScreenCapture to exfiltrate the contents of the user's screen.
Critical Impact
A malicious webpage visited by a user running GeoWebPlayer can silently capture the desktop and access sensitive plugin APIs over the local WebSocket interface.
Affected Products
- GeoVision GeoWebPlayer (Web Plugin) bundled with GV-VMS
- GeoVision WS Player bundled with GV-Cloud / VMS-Cloud
- Additional GeoVision software installations that ship the GeoWebPlayer addon
Discovery Timeline
- 2026-07-02 - CVE-2026-13125 published to NVD
- 2026-07-02 - Last updated in NVD database
- Reference - Talos Vulnerability Report TALOS-2026-2370
Technical Details for CVE-2026-13125
Vulnerability Analysis
GeoWebPlayer runs a WebSocket server on the local machine to bridge browser-based GeoVision interfaces with native functionality. The server does not validate the Origin header, does not require a shared secret, and does not require user consent before exposing method endpoints. Any script executing in the user's browser can open a WebSocket to the local endpoint and issue JSON-RPC style commands.
Among the exposed methods, create instantiates a player object, and getScreenCapture returns image data of the user's screen. Chaining these two calls yields a full-fidelity desktop screenshot without any prompt or indicator. Because the server binds locally, the attack is delivered through any visited webpage rather than requiring direct network reachability to the victim.
Root Cause
The root cause is missing authentication for a critical function [CWE-306]. GeoWebPlayer trusts every WebSocket client that can reach localhost, and browsers routinely allow scripts to connect to loopback WebSocket endpoints. There is no per-session token, no origin allowlist, and no user prompt gating sensitive capabilities such as screen capture.
Attack Vector
Exploitation requires the victim to visit an attacker-controlled or compromised website while GeoWebPlayer is installed and running. The attacker's JavaScript opens a WebSocket to the GeoWebPlayer port, issues the create method to initialize a player instance, and then calls getScreenCapture to receive the screen contents. The returned image is transmitted back to the attacker over standard HTTP or WebSocket channels. No credentials, prior compromise, or elevated privileges are needed.
Verified proof-of-concept code is not publicly available. Refer to the Talos Vulnerability Report TALOS-2026-2370 for the disclosed method sequence.
Detection Methods for CVE-2026-13125
Indicators of Compromise
- Outbound HTTP or WebSocket traffic from browsers to unfamiliar domains shortly after a local WebSocket connection to the GeoWebPlayer listener
- Unexpected instantiations of GeoWebPlayer processes from browser-initiated sessions
- Large image or base64-encoded payloads in outbound web traffic from workstations running GeoVision software
Detection Strategies
- Monitor loopback WebSocket connections to the GeoWebPlayer port and correlate with the parent browser process and the current page origin
- Alert on invocations of getScreenCapture recorded in GeoWebPlayer logs when the calling origin is not a GeoVision-managed domain
- Inspect browser telemetry for scripts opening ws://127.0.0.1 connections from non-GeoVision origins
Monitoring Recommendations
- Enable verbose logging within GeoWebPlayer and forward events to a centralized log platform for retention and search
- Baseline normal GeoVision web interface usage per host and flag deviations in method call patterns
- Track network egress volume from hosts running GV-VMS or GV-Cloud clients to detect screen-capture exfiltration
How to Mitigate CVE-2026-13125
Immediate Actions Required
- Inventory endpoints running GeoWebPlayer, Web Plugin, or WS Player, and identify hosts with the local WebSocket listener active
- Disable or uninstall GeoWebPlayer on systems that do not require the addon for GV-VMS or GV-Cloud web interfaces
- Restrict browser access to untrusted websites on workstations that must retain the plugin until a fix is applied
Patch Information
At the time of publication, GeoVision has not linked a specific patched build to CVE-2026-13125 in NVD. Consult the GeoVision Cybersecurity Resource for vendor advisories and updated installers, and apply the latest available GeoWebPlayer release once published.
Workarounds
- Block the GeoWebPlayer WebSocket port at the host firewall for all origins except required GeoVision management URLs
- Use browser policies or extensions to prevent scripts on arbitrary sites from connecting to localhost WebSocket endpoints
- Segment workstations that operate GV-VMS or GV-Cloud consoles from general-purpose web browsing
# Example: block non-loopback and non-GeoVision browser access to the plugin port on Windows
netsh advfirewall firewall add rule name="Block GeoWebPlayer External" \
dir=in action=block protocol=TCP localport=<GeoWebPlayer_Port> remoteip=any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
