{"id":"CVE-2018-25118","published":"2025-10-20T21:14:41Z","modified":"2026-04-07T14:03:45Z","title":"GeoVision Command Injection RCE via /PictureCatch.cgi","vendor":"GeoVision Inc.","product":"GV-BX1500","tier":"core","eol":null,"affectedVersions":[{"vendor":"GeoVision Inc.","product":"GV-BX1500","versions":["< November/December 2017 firmware"]},{"vendor":"GeoVision Inc.","product":"GV-MFD1501","versions":["< November/December 2017 firmware"]},{"vendor":"GeoVision Inc.","product":"GeoVision embedded IP devices","versions":["< November/December 2017 firmware"]}],"description":{"text":"GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":10,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01267,"percentile":0.69662,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-20","exploitedFirstSeen":"2025-10-20","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25118","date":"2025-10-20"},{"url":"https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi","date":"2025-10-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-24&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-25&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-26&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-27&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-28&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-29&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-30&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-31&host_type=src&vulnerability=cve-2018-25118","date":"2025-10-31"}],"evidenceTotal":31,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.exploit-db.com/exploits/43982","tags":["exploit"]},{"url":"https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15","tags":["exploit"]},{"url":"https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi","tags":["third-party-advisory"]},{"url":"https://www.geovision.com.tw/blog/?cat=14","tags":["release-notes","patch"]},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a","tags":["third-party-advisory","government-resource","exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-21605","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21605","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.exploit-db.com/exploits/43982","https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15","https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a"],"flow":[],"timeline":[{"date":"2025-10-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-25118","provenance":"source"},{"date":"2025-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2018-25118","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":60.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 374 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.93,"detail":"percentile 0.6966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}