Vulnerability Description
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Geovision | Gv-Vs12 Firmware | - |
| Geovision | Gv-Vs12 | - |
| Geovision | Gv-Vs11 Firmware | - |
| Geovision | Gv-Vs11 | - |
| Geovision | Gv-Dsp Lpr Firmware | - |
| Geovision | Gv-Dsp Lpr | 3.0 |
| Geovision | Gvlx 4 Firmware | - |
| Geovision | Gvlx 4 | 2.0 |
Related Weaknesses (CWE)
References
- https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.htmlThird Party Advisory
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovisioExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-US Government Resource
FAQ
What is CVE-2024-11120?
CVE-2024-11120 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device....
How severe is CVE-2024-11120?
CVE-2024-11120 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-11120?
Check the references section above for vendor advisories and patch information. Affected products include: Geovision Gv-Vs12 Firmware, Geovision Gv-Vs12, Geovision Gv-Vs11 Firmware, Geovision Gv-Vs11, Geovision Gv-Dsp Lpr Firmware.