CVE-2024-11120criticalunder attackCWE-78

CVE-2024-11120: critical vulnerability in GeoVision GV-DSP_LPR_V3

GeoVision EOL devices - OS Command Injection

Published · Updated

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 28%
from disclosure to weapon
Published on NVDNov 15
CISA KEV+173d
exploitation probability
28%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2025-05-28

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

GeoVision end-of-life devices allow attackers to run harmful commands on the device without logging in. This is a serious flaw that attackers are already actively exploiting to take control of these devices.

Technical detail

OS command injection vulnerability in EOL GeoVision devices permits unauthenticated remote attackers to inject and execute arbitrary system commands via unsanitized input. The attack requires network access to the device but no authentication credentials; successful exploitation grants full system-level access and has been actively weaponized in the wild.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
GeoVision · GV-DSP_LPR_V3GeoVision · GVLX 4 V2GeoVision · GVLX 4 V3GeoVision · GV-VS11GeoVision · GV-VS12
Related CVEs — GeoVision GV-DSP_LPR_V3

In the same product, most dangerous first.

CVE-2024-6047CRITICALGeoVision EOL device - OS Command InjectionEPSS 10.1%KEV
References
https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnethttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.htmlhttps://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html