CVE-2026-13131

{
  "id": "CVE-2026-13131",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-07-02T04:17:11.520",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nThe Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.\n\n\n#### connectInfo command index-out-of-bound"
    },
    {
      "lang": "es",
      "value": "GeoWebPlayer (también llamado ’Web Plugin’ en la documentación de GV-VMS y ’WS Player’ para VMS-Cloud) es un complemento que se puede instalar con varios software de GeoVision (GV-VMS, GV-Cloud, ...). Crea un servidor websocket que expande las capacidades de las diversas interfaces web proporcionadas por el software de GeoVision y puede ser necesario para que funcionen correctamente.\n\nEl servidor websocket puede aceptar varios comandos provenientes de localhost. Muchos de los comandos tomarán un valor de “index” que luego se utiliza para acceder a varias matrices para entrar en secciones críticas, realizar diversas acciones mediante llamadas a funciones, etc. Sin embargo, el valor de “index” generalmente no se verifica para un rango válido, y como tal, se puede utilizar para acceder a múltiples matrices fuera de los límites.\n\n#### Comando connectInfo: índice fuera de los límites"
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GeoWebPlayer",
          "defaultStatus": "unaffected",
          "packageName": "GeoWebPlayer",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "versions": [
            {
              "version": "V1.1.1.0",
              "status": "affected"
            },
            {
              "version": "V1.1.3.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-02T12:30:20.671962Z",
          "id": "CVE-2026-13131",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    },
    {
      "url": "https://www.geovision.com.tw/cyber_security.php",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    }
  ]
}