Critical severity9.8CISA KEVNVD Advisory· Published Nov 15, 2024· Updated Jun 17, 2026
CVE-2024-11120
CVE-2024-11120
Description
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:geovision:gv-vs11_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:geovision:gv-vs12_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*
- GeoVision/GV-DSP_LPR_V3v5Range: 0
- GeoVision/GV-VS11v5Range: 0
- GeoVision/GV-VS12v5Range: 0
- GeoVision/GVLX 4 V2v5Range: 0
- GeoVision/GVLX 4 V3v5Range: 0
Patches
Vulnerability mechanics
References
4- www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnetnvdExploitThird Party Advisory
- www.twcert.org.tw/en/cp-139-8237-26d7a-2.htmlnvdThird Party Advisory
- www.twcert.org.tw/tw/cp-132-8236-d4836-1.htmlnvdThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.