Skip to content
Fencer Vulns
critical 9.8

CVE-2024-6047 kev in the critical feed json

GeoVision EOL device - OS Command Injection

published 2024-06-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-47205

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2025-05-07
epss
10.1%
EPSS 10.1% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
18 mo ago
Patch by
2025-05-28 (17 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
GeoVision, Multiple Devices
CISA name
GeoVision Devices OS Command Injection Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1055 Process Injection exploitation
  • T1059 Command and Scripting Interpreter primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

10.07% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • akamai.com https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • GeoVision GV_DSP_LPR_V2
  • GeoVision GV_IPCAMD_GV_BX1500
  • GeoVision GV_IPCAMD_GV_CB220
  • GeoVision GV_IPCAMD_GV_EBL1100
  • GeoVision GV_IPCAMD_GV_EFD1100
  • GeoVision GV_IPCAMD_GV_FD2410
  • GeoVision GV_IPCAMD_GV_FD3400
  • GeoVision GV_IPCAMD_GV_FE3401
  • GeoVision GV_IPCAMD_GV_FE420
  • GeoVision GV-VS14_VS14
  • GeoVision GV_VS03
  • GeoVision GV_VS2410
  • GeoVision GV_VS28XX
  • GeoVision GV_VS216XX
  • GeoVision GV VS04A
  • GeoVision GV VS04H
  • GeoVision GVLX 4 V2
  • GeoVision GVLX 4 V3
  • GeoVision GV_IPCAMD_GV_BX130
  • GeoVision GV_GM8186_VS14
  • geovision gv-dsp_lpr_v2
  • geovision gv-bx1500
  • geovision gv-cb220
  • geovision gv-ebl1100
  • geovision gv-efd1100
  • geovision gv-fd2410
  • geovision gv-fd3400
  • geovision gv-fd3401
  • geovision gv-fe420
  • geovision gv-vs14
  • geovision gv-vs03
  • geovision gv-vs2410
  • geovision gv-vs04a
  • geovision gv-vs04h
  • geovision gv-lx_4_v2
  • geovision gv-lx_4_v3
  • geovision gv-vs28xx
  • geovision gv-vs216xx

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.