{"id":"CVE-2024-6047","kind":"vulnerability","aliases":["CVE-2024-6047"],"related":[],"title":"Certain EOL GeoVision devices fail to properly filter user input for the specific functionality","description":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"GeoVision network video devices contain an OS command injection flaw that lets a remote, unauthenticated attacker run arbitrary system commands on the device. The vendor has been exploited in the wild, and the affected products may be end-of-life or end-of-service.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-05-07T00:00:00+00:00","products":[{"name":"GeoVision Multiple Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-dsp lpr firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-bx130 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-bx1500 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-cb220 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-ebl1100 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-efd1100 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-fd2410 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-fd3400 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-fe3401 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-fe420 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-gm8186 vs14 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs14 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs03 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs2410 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs21600 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs04a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs04h firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gvlx 4 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs2800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"geovision gv-vs2820 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cameras","exploited","geovision","infrastructure","iot","self-hosted"],"not_affected_if":["no-geovision-devices"],"how_to_check":"Identify any GeoVision devices on the network and record their model and firmware version, then compare against the vendor advisory listed in the sources (unknown whether a specific version list is given).\nCheck whether the device is internet-reachable from outside the network.","fix":"Apply the vendor mitigation per the GeoVision advisory; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the affected device, as CISA directs.","status":"open","published_at":"2024-06-17T06:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:39+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:48:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per the GeoVision advisory; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the affected device, as CISA directs.","reach":"internet","summary":"GeoVision network video devices contain an OS command injection flaw that lets a remote, unauthenticated attacker run arbitrary system commands on the device. The vendor has been exploited in the wild, and the affected products may be end-of-life or end-of-service.","category":"infrastructure","who_cares":["geovision","iot","cameras","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the device without logging in.","analyst_note":"Find the GeoVision advisory and affected model/firmware list; the sources give no fixed version or specific mitigation steps.","how_to_check":"Identify any GeoVision devices on the network and record their model and firmware version, then compare against the vendor advisory listed in the sources (unknown whether a specific version list is given).\nCheck whether the device is internet-reachable from outside the network.\nunknown for any further command or setting","needs_analyst":true,"not_affected_if":["no-geovision-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2581,"output_tokens":456,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':234C '-2024':16A,19A '-6047':17A,20A '22':233C '4':113A 'action':224C 'affect':166B 'allow':189C 'and/or':211C 'appli':225C 'applic':231C 'arbitrari':150B,198C 'attack':148B,193C 'bod':232C 'bx130':33A 'bx1500':38A 'camera':125B 'cb220':43A 'certain':1A 'cisa':222C 'cloud':237C 'command':140B,152B,185C,200C 'contain':137B,182C 'could':204C 'cve':15A,18A 'devic':4A,136B,155B,181C 'devices':23A 'discontinu':219C,240C 'dsp':27A 'ebl1100':48A 'efd1100':53A 'end':171B,176B,207C,213C 'end-of-lif':170B,206C 'end-of-servic':175B,212C 'eo':216C 'eol':2A,210C 'execut':197C 'exploit':126B,160B 'fail':5A 'fd2410':58A 'fd3400':63A 'fe3401':68A 'fe420':73A 'filter':8A 'firmware':29A,34A,39A,44A,49A,54A,59A,64A,69A,74A,80A,85A,90A,95A,100A,105A,110A,114A,119A,124A 'flaw':142B 'follow':230C 'function':14A 'geovis':3A,127B,133B,180C 'geovision':21A,24A,30A,35A,40A,45A,50A,55A,60A,65A,70A,75A,81A,86A,91A,96A,101A,106A,111A,115A,120A 'gm8186':78A 'guidanc':235C 'gv':26A,32A,37A,42A,47A,52A,57A,62A,67A,72A,77A,83A,88A,93A,98A,103A,108A,117A,122A 'gv-bx130':31A 'gv-bx1500':36A 'gv-cb220':41A 'gv-dsp':25A 'gv-ebl1100':46A 'gv-efd1100':51A 'gv-fd2410':56A 'gv-fd3400':61A 'gv-fe3401':66A 'gv-fe420':71A 'gv-gm8186':76A 'gv-vs03':87A 'gv-vs04a':102A 'gv-vs04h':107A 'gv-vs14':82A 'gv-vs21600':97A 'gv-vs2410':92A 'gv-vs2800':116A 'gv-vs2820':121A 'gvlx':112A 'host':132B 'impact':202C 'infrastructur':128B 'inject':141B,186C,195C 'input':10A 'instruct':229C 'iot':129B 'let':144B 'life':173B,209C 'lpr':28A 'may':168B 'mitig':226C,246C 'multipl':179C 'multiple':22A 'network':134B 'os':139B,184C 'per':227C 'product':167B,203C,220C,244C 'proper':7A 'remot':146B,191C 'requir':223C 'run':149B 'self':131B 'self-host':130B 'servic':178B,215C,238C 'specif':13A 'system':151B,199C 'unauthent':147B,192C 'unavail':248C 'use':241C 'user':9A,217C 'util':221C 'vendor':157B,228C 'video':135B 'vs03':89A 'vs04a':104A 'vs04h':109A 'vs14':79A,84A 'vs21600':99A 'vs2410':94A 'vs2800':118A 'vs2820':123A 'vulner':187C 'wild':163B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-06-17T06:15:09+00:00","kev":{"dateAdded":"2025-05-07","dueDate":"2025-05-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-6047","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6047","severity":null,"published_at":"2025-05-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-6047","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6047","severity":null,"published_at":"2024-06-17T06:15:09+00:00","modified_at":"2026-06-17T08:17:10+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}