PT-2026-54625 · Geovision · Geowebplayer

Kelly Patterson + 2 · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-13132

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoWebPlayer (affected versions not specified)

Description GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an index value to access arrays for critical sections or function calls. Because the index value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the setStream command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-13132

Affected Products

Geowebplayer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-13132 · Security Note
• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://t.me/cveNotify/184305 · Telegram Post
• https://t.me/cveNotify/184741 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 · Note
• https://t.me/CVEtracker/58651 · Telegram Post