by Kastro
Paper/Archive/CVE-2024-11120

CVE-2024-11120

GeoVision GV-VS12 — GeoVision EOL devices - OS Command Injection

KEV · due 28 MayEPSS 28%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.1.981 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

Affected

ProductAffectedFixed inSource
GV-VS12all versions–CNA
GV-VS11all versions–CNA
GV-DSP_LPR_V3all versions–CNA
GVLX 4 V2all versions–CNA
GVLX 4 V3all versions–CNA
gv-vs12_firmwareall versions–CISA-ADP
gv-vs11_firmwareall versions–CISA-ADP
gv-dsp_lpr_v3_firmwareall versions–CISA-ADP
gvlx_4_v2_firmwareall versions–CISA-ADP
gvlx_4_v3_firmwareall versions–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8236-d4836-1.htmlwriteuptwcert.org.tw/en/cp-139-8237-26d7a-2.htmlrefakamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnetrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120kevcisa.gov/known-exploited-vulnerabilities-catalog