Read the docs
TI-2018-15344 Aliases CVE-2018-25118GHSA-jw2v-jc28-rfh8

GeoVision Command Injection RCE via /PictureCatch.cgi

Priority HIGH 82CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01267 69th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix Fixed GV-BX1500 (GeoVision Inc.): November/December 2017 firmwareGV-MFD1501 (GeoVision Inc.): November/December 2017 firmware+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeoVisionGV-BX1500before November/December 2017 firmwareNovember/December 2017 firmwarePatch availableCNA
GeoVisionGV-MFD1501before November/December 2017 firmwareNovember/December 2017 firmwarePatch availableCNA
GeoVisionGeoVision embedded IP devicesbefore November/December 2017 firmwareNovember/December 2017 firmwarePatch availableCNA
  • GV-BX1500 VendorGeoVision Affected before November/December 2017 firmware Fixed in November/December 2017 firmware Patch available CNA
  • GV-MFD1501 VendorGeoVision Affected before November/December 2017 firmware Fixed in November/December 2017 firmware Patch available CNA
  • GeoVision embedded IP devices VendorGeoVision Affected before November/December 2017 firmware Fixed in November/December 2017 firmware Patch available CNA

Remediation

  • Fix · CNA GV-BX1500 (GeoVision Inc.) Fixed in November/December 2017 firmware
  • Fix · CNA GV-MFD1501 (GeoVision Inc.) Fixed in November/December 2017 firmware
  • Fix · CNA GeoVision embedded IP devices (GeoVision Inc.) Fixed in November/December 2017 firmware

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25118
  2. 2026-10-03 Alias added: GHSA-jw2v-jc28-rfh8

References

Exploit 3

Patch 1

  • TI-2024-10304 GeoVision EOL devices - OS Command Injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-05603 GeoVision EOL device - OS Command Injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-22411 GeoVision Geowebserver 5.3.3 - Local FIle Inclusion CVSS 4.0HIGH 8.7
  • TI-2026-41681 GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr) CVSS 3.1CRITICAL 9.8
  • TI-2026-41680 GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr) CVSS 3.1CRITICAL 9.8
  • TI-2026-41679 GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd) CVSS 3.1CRITICAL 9.8
See all 105 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences