CVE-2026-13125: GeoWebPlayer Unauthenticated Websocket Remote Screen Capture Vulnerability

Technical summary

CVE-2026-13125 is an unauthenticated websocket server vulnerability in GeoWebPlayer (marketed as 'Web Plugin' or 'WS Player' depending on the GeoVision product variant). The plugin fails to implement authentication checks on websocket connections, violating CWE-306 (Missing Authentication for Critical Function). An attacker can instantiate screen capture operations by chaining the `create` and `getScreenCapture` API methods. The vulnerability is network-accessible and requires only user interaction—a victim must visit an attacker-controlled website while GeoWebPlayer is active—to expose screen content with high confidentiality impact, plus limited integrity and availability effects.

Business impact

Organizations deploying GeoVision video management systems face unauthorized surveillance of employee screens and potential access to sensitive visual information displayed during normal operations. Combined with the cross-site nature of the attack, this creates a persistent reconnaissance risk: any website an administrator or operator visits becomes a potential vector for harvesting screen data. This is particularly acute in security-sensitive environments (financial services, healthcare, law enforcement) where video system administrators may handle confidential data visible on-screen.

Affected systems

GeoWebPlayer is an optional addon component that can be installed alongside GeoVision products including GV-VMS (Video Management System), GV-Cloud, and other GeoVision software offerings. The vulnerability affects all versions in which GeoWebPlayer is deployed without authentication hardening. Note: no specific vendor/product version list was provided in the advisory; verify your GeoVision deployment details and cross-reference with GeoVision's official security notice for exact affected versions and SKUs.

Exploitability

Exploitability is moderate-to-high. An attacker must craft a malicious website or compromise a legitimate site to inject JavaScript that targets the local websocket server. The attack does not require authentication or privileged network access, only that a user with an active GeoWebPlayer session visits the attacker's website. No special tools or advanced techniques are needed; browser JavaScript is sufficient. However, the attacker's reach is limited to users who have GeoWebPlayer installed and active in their browser—not a universally present component.

Remediation

The primary remediation is to implement proper authentication on the websocket server. GeoVision must issue a patch that enforces authentication tokens or similar mechanisms before allowing API calls. Until a patch is available, organizations should restrict access to GeoWebPlayer by disabling the plugin in browsers where it is not actively required, and implement network segmentation to prevent untrusted websites from reaching the local websocket server. Consider using browser security policies (CSP, CORS) to limit cross-origin websocket connections if the plugin vendor provides guidance.

Patch guidance

Monitor GeoVision's official security advisories and product update channels for an authenticated version of GeoWebPlayer. When available, patches should be deployed across all GV-VMS, GV-Cloud, and related installations. Verify patch availability directly with GeoVision support or their security portal, as no specific patch version was disclosed at the time of publication. Test patches in a non-production environment before rolling out to operators. Consider temporarily disabling GeoWebPlayer in non-critical systems until authentication is confirmed in the patched release.

Detection guidance

Monitor network logs for unexpected websocket connections to localhost on the GeoWebPlayer service port. Browser security tools and network inspection can identify malicious JavaScript attempting to open cross-origin websocket connections. Log unusual API calls (particularly `create` and `getScreenCapture` sequences) if GeoWebPlayer provides access logs. Endpoint detection tools may flag JavaScript activity attempting to enumerate or interact with local websocket services. Network segmentation can be verified by testing whether external websites can successfully reach the GeoWebPlayer port.

Why prioritize this

This vulnerability merits HIGH priority due to the combination of zero-authentication attack surface, high confidentiality impact (screen capture), and the reality that video management system operators routinely interact with sensitive visual content. The cross-site nature widens the attack surface beyond traditional network boundaries. While exploitation requires user interaction, the interaction is passive (simply visiting a website), making it highly feasible in practice. Organizations running GeoVision systems in sensitive environments should treat this as urgent.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects: network-accessible attack vector (AV:N), no special conditions required (AC:L), no authentication needed (PR:N), low user interaction requirement (UI:R), scope change enabling cross-site attacks (S:C), and high confidentiality impact from screen capture (C:H) offset partially by lower integrity and availability impacts (I:L, A:L). The scope change is the critical differentiator—the vulnerability allows an attacker to impact resources beyond the security scope of the vulnerable component itself.

Frequently asked questions