Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-11120: GeoVision devices allow remote command execution

CVE-2024-11120 · published 1 year ago · actively exploited

Summary

GeoVision cameras and firmware can be tricked by an unauthenticated attacker into running any system command. This could let an attacker take control of the device or disrupt its operation, especially on models that are no longer supported. Stop using the affected devices and replace them with supported alternatives.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
geovision	multiple devices	All versions
geovision	gv-vs12_firmware	All versions `cpe:2.3:o:geovision:gv-vs12_firmware:-:::::::*`
geovision	gv-vs11_firmware	All versions `cpe:2.3:o:geovision:gv-vs11_firmware:-:::::::*`
geovision	gv-dsp_lpr_firmware	All versions `cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:::::::*`
geovision	gvlx_4_firmware	All versions `cpe:2.3:o:geovision:gvlx_4_firmware:-:::::::*`

Original advisory text

GeoVision Devices OS Command Injection Vulnerability

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

References

https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html Third Party Advisory
https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovisio... Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 3 days

and check for signs of compromise

Known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

28% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published15 Nov 2024

Updated30 Sep 2026

First seen6 Mar 2026

Sources

CVE-2024-11120 · CISA KEV

CVE-2024-11120 · NVD

Track software like this

Free during beta