CVE-2018-25118

CRITICAL EPSS 67.2%
Published Oct 20, 20258mo ago · Modified Jun 17, 20261w ago
10.0 CVSS 4.0
Critical
Find Similar
Published Oct 20, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago

Description

GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.

CVSS Details

Base Score
10.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
67.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

References 5

  • github.com https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15
  • cisa.gov https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
  • exploit-db.com https://www.exploit-db.com/exploits/43982
  • geovision.com.tw https://www.geovision.com.tw/blog/?cat=14
  • vulncheck.com https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.