{"id":"CVE-2024-11120","kind":"vulnerability","aliases":["CVE-2024-11120"],"related":[],"title":"Certain EOL GeoVision devices have an OS Command Injection vulnerability","description":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"GeoVision network devices such as IP cameras and recorders contain an OS command injection flaw. A remote attacker without credentials can run arbitrary system commands on the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-05-07T00:00:00+00:00","products":[{"name":"GeoVision Multiple Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs12 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs11 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-dsp lpr firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gvlx 4 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","geovision","infrastructure","ip-cameras","self-hosted"],"not_affected_if":["no-geovision-devices"],"how_to_check":"Identify any GeoVision devices on the network and record their model and firmware version; the sources do not give a specific command or file to check.","fix":"Apply the vendor's mitigation or patch if one exists; CISA says to discontinue use of the product if mitigations are unavailable, and the impacted products may be end-of-life or end-of-service.","status":"open","published_at":"2024-11-15T02:15:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:39+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:48:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's mitigation or patch if one exists; CISA says to discontinue use of the product if mitigations are unavailable, and the impacted products may be end-of-life or end-of-service.\nunknown","reach":"internet","summary":"GeoVision network devices such as IP cameras and recorders contain an OS command injection flaw. A remote attacker without credentials can run arbitrary system commands on the device.","category":"infrastructure","who_cares":["geovision","ip-cameras","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands on the device and takes full control.","analyst_note":"Find the GeoVision vendor advisory and affected model/firmware list; the KEV entry alone gives no patch versions or check steps.","how_to_check":"Identify any GeoVision devices on the network and record their model and firmware version; the sources do not give a specific command or file to check.\nunknown","needs_analyst":true,"not_affected_if":["no-geovision-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000456,"input_tokens":2581,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':132C '-11120':13A,16A '-2024':12A,15A '22':131C '4':38A 'action':122C 'allow':87C 'and/or':109C 'appli':123C 'applic':129C 'arbitrari':71B,96C 'attack':66B,91C 'bod':130C 'camera':45B,55B 'certain':1A 'cisa':120C 'cloud':135C 'command':8A,61B,73B,83C,98C 'contain':58B,80C 'could':102C 'credenti':68B 'cve':11A,14A 'devic':4A,51B,76B,79C 'devices':19A 'discontinu':117C,138C 'dsp':33A 'end':105C,111C 'end-of-lif':104C 'end-of-servic':110C 'eo':114C 'eol':2A,108C 'execut':95C 'exploit':40B 'firmware':24A,29A,35A,39A 'flaw':63B 'follow':128C 'geovis':3A,41B,49B,78C 'geovision':17A,20A,25A,30A,36A 'guidanc':133C 'gv':22A,27A,32A 'gv-dsp':31A 'gv-vs11':26A 'gv-vs12':21A 'gvlx':37A 'host':48B 'impact':100C 'infrastructur':42B 'inject':9A,62B,84C,93C 'instruct':127C 'ip':44B,54B 'ip-camera':43B 'life':107C 'lpr':34A 'mitig':124C,144C 'multipl':77C 'multiple':18A 'network':50B 'os':7A,60B,82C 'per':125C 'product':101C,118C,142C 'record':57B 'remot':65B,89C 'requir':121C 'run':70B 'self':47B 'self-host':46B 'servic':113C,136C 'system':72B,97C 'unauthent':90C 'unavail':146C 'use':139C 'user':115C 'util':119C 'vendor':126C 'vs11':28A 'vs12':23A 'vulner':10A,85C 'without':67B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-15T02:15:17+00:00","kev":{"dateAdded":"2025-05-07","dueDate":"2025-05-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-11120","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11120","severity":null,"published_at":"2025-05-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-11120","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11120","severity":null,"published_at":"2024-11-15T02:15:17+00:00","modified_at":"2026-06-17T06:57:06+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}