CVE-2024-11120 (GCVE-0-2024-11120)

Vulnerability from cvelistv5 – Published: 2024-11-15 02:00 – Updated: 2025-10-21 22:55 Unsupported When Assigned X_Known Exploited Vulnerability
VLAI CISA Shadowserver KEVIntel
Title
GeoVision EOL devices - OS Command Injection
Summary
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
GeoVision GV-VS12 Affected: 0
Create a notification for this product.
GeoVision GV-VS11 Affected: 0
Create a notification for this product.
GeoVision GV-DSP_LPR_V3 Affected: 0
Create a notification for this product.
GeoVision GVLX 4 V2 Affected: 0
Create a notification for this product.
GeoVision GVLX 4 V3 Affected: 0
Create a notification for this product.
geovision gv-vs12_firmware Affected: 0 , < * (custom)
    cpe:2.3:o:geovision:gv-vs12_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
geovision gv-vs11_firmware Affected: 0 , < * (custom)
    cpe:2.3:o:geovision:gv-vs11_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
geovision gv-dsp_lpr_v3_firmware Affected: 0 , < * (custom)
    cpe:2.3:o:geovision:gv-dsp_lpr_v3_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
geovision gvlx_4_v2_firmware Affected: 0 , < * (custom)
    cpe:2.3:o:geovision:gvlx_4_v2_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
geovision gvlx_4_v3_firmware Affected: 0 , < * (custom)
    cpe:2.3:o:geovision:gvlx_4_v3_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-11-15 01:56
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 91714911-e30c-4808-9f20-4596f3762005

Vulnerability ID: CVE-2024-11120

Status: Confirmed

Status Updated: 2025-05-07 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-05-07
Asserted: 2025-05-07
Scope
Notes: KEV entry: GeoVision Devices OS Command Injection Vulnerability | Affected: GeoVision / Multiple Devices | Description: Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-05-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-11120
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-78
Feed CISA Known Exploited Vulnerabilities Catalog
Product Multiple Devices
Due Date 2025-05-28
Date Added 2025-05-07
Vendorproject GeoVision
Vulnerabilityname GeoVision Devices OS Command Injection Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 11af19e4-0ab0-4b81-a716-7657fc1b193f

Vulnerability ID: CVE-2024-11120

Status: Confirmed

Status Updated: 2025-04-07 00:00 UTC

Exploited: Yes

Characteristics
Severity: 98.0
Timestamps
First Seen: 2025-04-06
Asserted: 2025-04-06
Last Seen: 2025-04-07
Scope
Asset Exposure: ['internet-facing']
Notes: Affected: GeoVision / GeoVision multiple EOL products | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-04-07: 10
Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details
1D 1
Iot yes
Feed Shadowserver Foundation honeypot/exploited-vulnerabilities
Type http-scan
Class video-system
7D Avg 0
Vendor GeoVision
30D Avg 0
90D Avg 0
Product GeoVision multiple EOL products
Cisa Kev no
Connections 10
Observation Date 2025-04-07
Vulnerability Class CVSS
Vulnerability Score 9.8
Vulnerability Severity Critical
References
Created: 2026-06-30 09:42 UTC | Updated: 2026-06-30 11:54 UTC
KEVIntel
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 27f11f59-f3f6-4bb2-b1e3-0154fb1cf56c

Vulnerability ID: CVE-2024-11120

Status: Confirmed

Status Updated: 2025-05-07 06:17 UTC

Exploited: Yes

Timestamps
First Seen: 2025-05-07
Asserted: 2025-05-07
Scope
Notes: KEVIntel entry: GeoVision EOL devices - OS Command Injection | Affected: GeoVision / GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, GVLX 4 V3 | CVSS: 9.8 (CRITICAL) | EPSS: 0.28554 | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title GeoVision EOL devices - OS Command Injection
Vendor GeoVision
Product GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, GVLX 4 V3
Added Date 2025-05-07T06:17:12.074Z
Cvss Score 9.8
Epss Score 0.28554
Cvss Severity CRITICAL
Epss Percentile 0.97883
Used In Malware unknown
Ahead Of Cisa Kev 
{
  "count": 391,
  "unit": "day"
}
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:04 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:geovision:gv-vs12_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gv-vs12_firmware",
            "vendor": "geovision",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:geovision:gv-vs11_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gv-vs11_firmware",
            "vendor": "geovision",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:geovision:gv-dsp_lpr_v3_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gv-dsp_lpr_v3_firmware",
            "vendor": "geovision",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:geovision:gvlx_4_v2_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gvlx_4_v2_firmware",
            "vendor": "geovision",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:geovision:gvlx_4_v3_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gvlx_4_v3_firmware",
            "vendor": "geovision",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11120",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T17:12:05.450406Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-05-07",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:36.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "url": "https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-05-07T00:00:00.000Z",
            "value": "CVE-2024-11120 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GV-VS12",
          "vendor": "GeoVision",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GV-VS11",
          "vendor": "GeoVision",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GV-DSP_LPR_V3",
          "vendor": "GeoVision",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GVLX 4 V2",
          "vendor": "GeoVision",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GVLX 4 V3",
          "vendor": "GeoVision",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "datePublic": "2024-11-15T01:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports."
            }
          ],
          "value": "Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T02:00:27.361Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u0026nbsp; The affected devices are no longer being maintained. It is recommended to replace them.\u003cbr\u003e"
            }
          ],
          "value": "The affected devices are no longer being maintained. It is recommended to replace them."
        }
      ],
      "source": {
        "advisory": "TVN-202411014",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "unsupported-when-assigned",
        "x_known-exploited-vulnerability"
      ],
      "title": "GeoVision EOL devices - OS Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2024-11120",
    "datePublished": "2024-11-15T02:00:27.361Z",
    "dateReserved": "2024-11-12T06:23:33.571Z",
    "dateUpdated": "2025-10-21T22:55:36.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-11120",
      "cwes": "[\"CWE-78\"]",
      "dateAdded": "2025-05-07",
      "dueDate": "2025-05-28",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-11120",
      "product": "Multiple Devices",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
      "vendorProject": "GeoVision",
      "vulnerabilityName": "GeoVision Devices OS Command Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2024-11120",
      "date": "2026-07-11",
      "epss": "0.28554",
      "percentile": "0.97905"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:geovision:gv-vs12_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C78AF1F-A287-4282-84F4-E6087250EEFE\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:geovision:gv-vs12:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A129787-4673-4701-933C-BD5365B61A53\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:geovision:gv-vs11_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF1E4228-CE1E-4BAA-ADE8-F045B7A0B958\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:geovision:gv-vs11:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"42E883F3-769C-4266-B75C-98CCB217471C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A816357-E53E-45DB-8655-2168D9B81F9F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:geovision:gv-dsp_lpr:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43C96B07-009A-44F1-97A4-91A4EC11B8CA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F102B6E2-FF3F-4A1A-B133-E06567EE6653\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:geovision:gvlx_4:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CC0F181D-09E9-43CF-93A5-DA699F4436C5\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F102B6E2-FF3F-4A1A-B133-E06567EE6653\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:geovision:gvlx_4:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3699699F-80E7-44C8-8564-1448704BCCE0\"}]}]}]",
      "cveTags": "[{\"sourceIdentifier\": \"twcert@cert.org.tw\", \"tags\": [\"unsupported-when-assigned\"]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.\"}, {\"lang\": \"es\", \"value\": \"Algunos dispositivos GeoVision al final de su vida \\u00fatil tienen una vulnerabilidad de inyecci\\u00f3n de comandos del sistema operativo. Los atacantes remotos no autenticados pueden aprovechar esta vulnerabilidad para inyectar y ejecutar comandos arbitrarios del sistema en el dispositivo. Adem\\u00e1s, esta vulnerabilidad ya ha sido explotada por atacantes y hemos recibido informes relacionados.\"}]",
      "id": "CVE-2024-11120",
      "lastModified": "2024-12-05T15:30:58.490",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"twcert@cert.org.tw\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-11-15T02:15:17.757",
      "references": "[{\"url\": \"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html\", \"source\": \"twcert@cert.org.tw\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html\", \"source\": \"twcert@cert.org.tw\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "twcert@cert.org.tw",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"twcert@cert.org.tw\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-11120\",\"sourceIdentifier\":\"twcert@cert.org.tw\",\"published\":\"2024-11-15T02:15:17.757\",\"lastModified\":\"2026-06-17T06:57:06.503\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[{\"sourceIdentifier\":\"twcert@cert.org.tw\",\"tags\":[\"unsupported-when-assigned\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.\"},{\"lang\":\"es\",\"value\":\"Algunos dispositivos GeoVision al final de su vida \u00fatil tienen una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo. Los atacantes remotos no autenticados pueden aprovechar esta vulnerabilidad para inyectar y ejecutar comandos arbitrarios del sistema en el dispositivo. Adem\u00e1s, esta vulnerabilidad ya ha sido explotada por atacantes y hemos recibido informes relacionados.\"}],\"affected\":[{\"source\":\"twcert@cert.org.tw\",\"affectedData\":[{\"vendor\":\"GeoVision\",\"product\":\"GV-VS12\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\"}]},{\"vendor\":\"GeoVision\",\"product\":\"GV-VS11\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\"}]},{\"vendor\":\"GeoVision\",\"product\":\"GV-DSP_LPR_V3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\"}]},{\"vendor\":\"GeoVision\",\"product\":\"GVLX 4 V2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\"}]},{\"vendor\":\"GeoVision\",\"product\":\"GVLX 4 V3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"geovision\",\"product\":\"gv-vs12_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:geovision:gv-vs12_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"geovision\",\"product\":\"gv-vs11_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:geovision:gv-vs11_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"geovision\",\"product\":\"gv-dsp_lpr_v3_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:geovision:gv-dsp_lpr_v3_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"geovision\",\"product\":\"gvlx_4_v2_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:geovision:gvlx_4_v2_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"geovision\",\"product\":\"gvlx_4_v3_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:geovision:gvlx_4_v3_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-05-07T17:12:05.450406Z\",\"id\":\"CVE-2024-11120\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2025-05-07\",\"cisaActionDue\":\"2025-05-28\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"GeoVision Devices OS Command Injection Vulnerability\",\"weaknesses\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geovision:gv-vs12_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C78AF1F-A287-4282-84F4-E6087250EEFE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geovision:gv-vs12:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A129787-4673-4701-933C-BD5365B61A53\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geovision:gv-vs11_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF1E4228-CE1E-4BAA-ADE8-F045B7A0B958\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geovision:gv-vs11:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42E883F3-769C-4266-B75C-98CCB217471C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A816357-E53E-45DB-8655-2168D9B81F9F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geovision:gv-dsp_lpr:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43C96B07-009A-44F1-97A4-91A4EC11B8CA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F102B6E2-FF3F-4A1A-B133-E06567EE6653\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geovision:gvlx_4:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC0F181D-09E9-43CF-93A5-DA699F4436C5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F102B6E2-FF3F-4A1A-B133-E06567EE6653\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geovision:gvlx_4:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3699699F-80E7-44C8-8564-1448704BCCE0\"}]}]}],\"references\":[{\"url\":\"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T10:38:02+00:00",
      "cve": "CVE-2024-11120",
      "id": "CVE-2024-11120",
      "initial_release_date": "2024-11-15T01:56:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "GeoVision EOL devices - OS Command Injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-11120.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"GV-VS12\", \"vendor\": \"GeoVision\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"GV-VS11\", \"vendor\": \"GeoVision\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"GV-DSP_LPR_V3\", \"vendor\": \"GeoVision\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"GVLX 4 V2\", \"vendor\": \"GeoVision\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"GVLX 4 V3\", \"vendor\": \"GeoVision\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}]}], \"datePublic\": \"2024-11-15T01:56:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.\"}], \"value\": \"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.\"}], \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88 OS Command Injection\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"shortName\": \"twcert\", \"dateUpdated\": \"2024-11-15T02:00:27.361Z\"}, \"references\": [{\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u0026nbsp; The affected devices are no longer being maintained. It is recommended to replace them.\u003cbr\u003e\"}], \"value\": \"The affected devices are no longer being maintained. It is recommended to replace them.\"}], \"source\": {\"advisory\": \"TVN-202411014\", \"discovery\": \"EXTERNAL\"}, \"tags\": [\"unsupported-when-assigned\", \"x_known-exploited-vulnerability\"], \"title\": \"GeoVision EOL devices - OS Command Injection\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-11120\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-07T17:12:05.450406Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-05-07\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:geovision:gv-vs12_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"geovision\", \"product\": \"gv-vs12_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:geovision:gv-vs11_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"geovision\", \"product\": \"gv-vs11_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:geovision:gv-dsp_lpr_v3_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"geovision\", \"product\": \"gv-dsp_lpr_v3_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:geovision:gvlx_4_v2_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"geovision\", \"product\": \"gvlx_4_v2_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:geovision:gvlx_4_v3_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"geovision\", \"product\": \"gvlx_4_v3_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"references\": [{\"url\": \"https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet\"}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-15T19:39:06.804Z\"}, \"timeline\": [{\"time\": \"2025-05-07T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2024-11120 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-11120\", \"assignerOrgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"twcert\", \"dateReserved\": \"2024-11-12T06:23:33.571Z\", \"datePublished\": \"2024-11-15T02:00:27.361Z\", \"dateUpdated\": \"2025-10-21T19:44:14.225Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.