Actively exploited · Published Nov 15, 2024 · Assigned by twcert
CVE-2024-11120GeoVision EOL devices - OS Command Injection
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in GV-DSP_LPR_V3 from GeoVision. Attackers are actively exploiting it in the wild (listed by CISA on May 7, 2025). The chance it is exploited in the next 30 days is estimated at 28.4% (higher than 98% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 28, 2025.
Official description
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html third-party-advisory
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120 government-resource