← Back

CVE-2024-11120

nvd nist
Published: Nov 15, 2024Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

Affected (4)

Geovision
4 products
Gv Vs12 Firmware
Gv Vs11 Firmware
Gv Dsp Lpr Firmware
Gvlx 4 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gv Vs12 Firmware
All versions
Running on/withPlatform Versions
Geovision
Gv Vs12
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gv Vs11 Firmware
All versions
Running on/withPlatform Versions
Geovision
Gv Vs11
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gv Dsp Lpr Firmware
All versions
Running on/withPlatform Versions
Geovision
Gv Dsp Lpr
Version 3.0
Configuration D
1 platform
Running on/withPlatform Versions
Geovision
Gvlx 4
Version 2.0
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gvlx 4 Firmware
All versions
Running on/withPlatform Versions
Geovision
Gvlx 4
Version 3.0

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

Source: twcert@cert.org.tw
Third Party Advisory
Source: twcert@cert.org.tw
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.