CVE-2018-25118
CRITICAL EXPLOITEDGeoVision embedded IP devices - Command Injection
Title source: llmExploitation Summary
CVE-2018-25118 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including bashis.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Geovision IP cameras, including remote command execution via command injection in CGI parameters, unauthorized access to sensitive endpoints, and memory corruption issues like double free and stack overflow. The PoC includes curl commands to trigger these vulnerabilities, leading to arbitrary code execution and privilege escalation.
Description
GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in Geovision IP cameras, including remote command execution via command injection in CGI parameters, unauthorized access to sensitive endpoints, and memory corruption issues like double free and stack overflow. The PoC includes curl commands to trigger these vulnerabilities, leading to arbitrary code execution and privilege escalation.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H