CVE-2024-11120

🗓️ 15 Nov 2024 02:00:27Reported by twcertType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 260 Views

Certain GeoVision Devices OS Command Injection Vulnerability Exploite

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2024-11120	15 Nov 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of Geovision GV-VS12, GV-VS11, GV-DSP LPR V3, GVLX 4, and GVLX 4 IP video server microprogramming systems arises from the failure to eliminate special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.	18 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-11120	15 Nov 202402:14	–	circl
CISA KEV Catalog	GeoVision Devices OS Command Injection Vulnerability	7 May 202500:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	7 May 202512:00	–	cisa
CNNVD	GeoVision EOL 操作系统命令注入漏洞	15 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-11120 GeoVision EOL devices - OS Command Injection	15 Nov 202402:00	–	cvelist
NVD	CVE-2024-11120	15 Nov 202402:15	–	nvd
Positive Technologies	PT-2024-8246	14 Nov 202400:00	–	ptsecurity
Tenable Nessus	Geo Vision EoL Devices Improper Neutralization of Special Elements used in an OS Command (CVE-2024-11120)	13 May 202500:00	–	nessus

NVD

Node

geovision gv-vs12_firmwareMatch-

AND

geovision gv-vs12Match-

Node

geovision gv-vs11_firmwareMatch-

AND

geovision gv-vs11Match-

Node

geovision gv-dsp_lpr_firmwareMatch-

AND

geovision gv-dsp_lprMatch3.0

Node

geovision gvlx_4_firmwareMatch-

AND

geovision gvlx_4Match2.0

Node

geovision gvlx_4_firmwareMatch-

AND

geovision gvlx_4Match3.0

[
  {
    "defaultStatus": "unaffected",
    "product": "GV-VS12",
    "vendor": "GeoVision",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GV-VS11",
    "vendor": "GeoVision",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GV-DSP_LPR_V3",
    "vendor": "GeoVision",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GVLX 4 V2",
    "vendor": "GeoVision",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GVLX 4 V3",
    "vendor": "GeoVision",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

Source	Link
twcert	www.twcert.org.tw/en/cp-139-8237-26d7a-2.html
twcert	www.twcert.org.tw/tw/cp-132-8236-d4836-1.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
akamai	www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet

30 Oct 2025 20:09Current

10High risk

Vulners AI Score10

CVSS 3.19.8

EPSS0.66138

SSVC