GeoVision Devices OS Command Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2024-11120 · Published 15/11/2024 · updated 17/06/2026

GeoVision Devices OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/05/2025. Patch affected systems as an emergency.

In short

CVE-2024-11120 is a CRITICAL (CVSS 9.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 07/05/2025.
Chance of exploitation in the next 30 days (EPSS): 28.4%, higher than 98.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
Multiple Devices GeoVision	Versions not published yet (product named by CISA KEV)

Description

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

References

twcert.org.tw/en/cp-139-8237-26d7a-2.html · Third Party Advisory
twcert.org.tw/tw/cp-132-8236-d4836-1.html · Third Party Advisory
akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2024-11120

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free