PoC Index

CVE-2024-11120

KEVCRITICAL 9.8EPSS 28.4%

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
28.39% chance of exploitation in the next 30 days, 98th percentile
CISA KEV
added 2025-05-07
Published
2024-11-15
Updated
2025-10-21

Proof-of-concept exploits (1)

References

Related