Critical severity · published Oct 20, 2025
CVE-2018-25118
GeoVision Command Injection RCE via /PictureCatch.cgi
10.0
CVSS
1.3%
EPSS
No
On KEV
Description
GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GV
GV-BX1500 · GeoVision Inc.
before November/December 2017 firmware · source: vendor
GV
GV-MFD1501 · GeoVision Inc.
before November/December 2017 firmware · source: vendor
GE
GeoVision embedded IP devices · GeoVision Inc.
before November/December 2017 firmware · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25118
github.com
https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15
www.cisa.gov
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
www.exploit-db.com
https://www.exploit-db.com/exploits/43982
www.geovision.com.tw
https://www.geovision.com.tw/blog/?cat=14
www.vulncheck.com
https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi