CVE-2018-25118CWE-78

GeoVision Command Injection RCE via /PictureCatch.cgi

Critical · published October 20, 2025

CVSS v4.0
10.0
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01267 · 69.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-20T21:14Z
EPSS history
Timeline
  • 20 OCT 21:14Z
    GeoVision Command Injection RCE via /PictureCatch.cgi
    cvelistv5