CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-6047
Critical (9.8) in GeoVision Multiple Devices. In CISA KEV since 2025-05-07. EPSS 10% chance of exploitation in the next 30 days.
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Severity
- EPSS
- 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-05-07, due 2025-05-28
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- geovision:gv-bx130_firmware
- geovision:gv-bx1500_firmware
- geovision:gv-cb220_firmware
- geovision:gv-dsp_lpr_firmware
- geovision:gv-ebl1100_firmware
- geovision:gv-efd1100_firmware
- geovision:gv-fd2410_firmware
- geovision:gv-fd3400_firmware
- geovision:gv-fe3401_firmware
- geovision:gv-fe420_firmware
- geovision:gv-gm8186_vs14_firmware
- geovision:gv-vs03_firmware
- geovision:gv-vs04a_firmware
- geovision:gv-vs04h_firmware
- geovision:gv-vs14_firmware
- geovision:gv-vs21600_firmware
- geovision:gv-vs2410_firmware
- geovision:gv-vs2800_firmware
- geovision:gv-vs2820_firmware
- geovision:gvlx_4_firmware
References
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet