CVE-2024-6047

GeoVision EOL device - OS Command Injection

State: Published
Severity: 9.8 Critical
Published: Jun 17, 2024
Updated: Oct 21, 2025
Reserved: Jun 17, 2024

Description

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
GV_DSP_LPR_V2GeoVision	allAffected
GV_IPCAMD_GV_BX1500GeoVision	allAffected
GV_IPCAMD_GV_CB220GeoVision	allAffected
GV_IPCAMD_GV_EBL1100GeoVision	allAffected
GV_IPCAMD_GV_EFD1100GeoVision	allAffected
GV_IPCAMD_GV_FD2410GeoVision	allAffected
GV_IPCAMD_GV_FD3400GeoVision	allAffected
GV_IPCAMD_GV_FE3401GeoVision	allAffected
GV_IPCAMD_GV_FE420GeoVision	allAffected
GV-VS14_VS14GeoVision	allAffected
GV_VS03GeoVision	allAffected
GV_VS2410GeoVision	allAffected
GV_VS28XXGeoVision	allAffected
GV_VS216XXGeoVision	allAffected
GV VS04AGeoVision	allAffected
GV VS04HGeoVision	allAffected
GVLX 4 V2GeoVision	allAffected
GVLX 4 V3GeoVision	allAffected
GV_IPCAMD_GV_BX130GeoVision	allAffected
GV_GM8186_VS14GeoVision	allAffected

References

https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.htmlthird-party-advisory
https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6047government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.