The GeoWebPlayer addon embeds a WebSocket server that accepts connections without authentication, exposing privileged APIs such as "create" and "getScreenCapture." An attacker can invoke these functions to capture the current contents of the victim’s screen, obtaining credentials, sensitive documents, or other confidential information. The vulnerability is classified as CWE‑306, highlighting a missing authentication requirement for data processing.

GeoVision Inc. provides GeoWebPlayer version 1.1.1.0 for both 64‑bit and Windows platforms, which can be installed with GeoVision products like GV‑VMS and GV‑Cloud. The fix is deployed in GeoWebPlayer version 1.1.3.0 for the same platforms.

The CVSS score of 8.8 denotes high severity, while the EPSS score of < 1% indicates a low but nonzero likelihood of exploitation today. It is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated network connection to the WebSocket endpoint; a malicious website could open a WebSocket channel to the victim’s device and invoke privileged methods, as no authentication is required to access the server.