CVE-2024-6047

GeoVision EOL device - OS Command Injection

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Affected

GeoVision · GV_DSP_LPR_V2 · GV_IPCAMD_GV_BX1500 · GV_IPCAMD_GV_CB220 · GV_IPCAMD_GV_EBL1100 · GV_IPCAMD_GV_EFD1100 · GV_IPCAMD_GV_FD2410

CVSS v3.1 CERT

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

10.07% chance of exploitation in the next 30 days, 96th percentile

CISA KEV

added 2025-05-07

Published

2024-06-17

Updated

2025-10-21

Proof-of-concept exploits (1)

• https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-bot…

Security advisories

• https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html
• https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html

References

• CVE Record
• NVD entry