Geo Vision EoL Devices Improper Neutralization of Special Elements used in an OS Command (CVE-2024-11120)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503224);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/13");

  script_cve_id("CVE-2024-11120");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/05/28");

  script_name(english:"Geo Vision EoL Devices Improper Neutralization of Special Elements used in an OS Command (CVE-2024-11120)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Certain EOL GeoVision devices have an OS Command Injection
vulnerability. Unauthenticated remote attackers can exploit this
vulnerability to inject and execute arbitrary system commands on the
device. Moreover, this vulnerability has already been exploited by
attackers, and we have received related reports.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html");
  script_set_attribute(attribute:"see_also", value:"https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html");
  # https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?27ab061e");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-11120");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs11_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs12_firmware:-");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/GeoVision");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/GeoVision');

var asset = tenable_ot::assets::get(vendor:'GeoVision');

var vuln_cpes = {
    "cpe:/o:geovision:gv-vs12_firmware:-" :
        {"family" : "GeoVisionVideoServers"},
    "cpe:/o:geovision:gv-vs11_firmware:-" :
        {"family" : "GeoVisionVideoServers"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);