CVE-2024-11120
GeoVision Devices OS Command Injection Vulnerability
Description
CVE-2024-11120 is a critical OS command injection vulnerability affecting multiple end-of-life (EOL) GeoVision devices, including the GV-VS12, GV-VS11, GV-DSP LPR, and GVLX 4 video server and license plate recognition firmware. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary system commands on the affected devices without any authentication or user interaction. With a maximum CVSS v3.1 base score of 9.8 (Critical), this vulnerability has already been exploited by attackers in Mirai-based botnet campaigns. CISA added CVE-2024-11120 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 28, 2025, and its EPSS score of 66.14% at the 98th percentile places it among the most actively exploited vulnerabilities currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| geovision | gv-vs12 firmware | - |
| geovision | gv-vs11 firmware | - |
| geovision | gv-dsp lpr firmware | - |
| geovision | gvlx 4 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html(Third Party Advisory)
- https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html(Third Party Advisory)
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2024-11120 is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). This weakness occurs when an application constructs system-level commands using externally supplied input without proper neutralization of special characters that modify command behavior. In the affected GeoVision devices, user-supplied input is passed directly to operating system command execution functions without sanitization, enabling an unauthenticated attacker to inject arbitrary commands that execute with the device's system privileges.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
With a CVSS v3.1 score of 9.8 (Critical), CVE-2024-11120 represents one of the most dangerous vulnerability profiles possible. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), delivering high impact across confidentiality, integrity, and availability. An unauthenticated remote attacker can execute arbitrary commands on the device, enabling complete device takeover including access to video feeds, stored footage, and network credentials. The devices can be enrolled into botnets for DDoS attacks, used as network pivot points for lateral movement, or leveraged for surveillance. The EPSS score of 66.14% at the 98th percentile indicates near-certain exploitation, and research from Akamai confirms these devices are actively being recruited into Mirai-variant botnets. Since the affected devices are end-of-life, no vendor patches are available, making this an unresolvable vulnerability for devices that remain connected to the network.
Exploit Maturity
CVE-2024-11120 demonstrates very high exploit maturity with confirmed active exploitation in Mirai-based botnet campaigns. Public exploit research is available via Akamai's analysis of active exploitation targeting GeoVision IoT devices, which documents the use of this vulnerability for botnet recruitment. CISA added CVE-2024-11120 to the Known Exploited Vulnerabilities catalog on May 7, 2025, confirming government-verified active exploitation. The EPSS score of 66.14% at the 98th percentile places this among the top 2% of all vulnerabilities for exploitation probability. The combination of unauthenticated remote exploitation, end-of-life status with no available patches, and active botnet targeting makes this one of the highest-risk vulnerabilities for organizations with GeoVision devices still in service.
Remediation
-
Decommission affected GeoVision devices immediately. The GV-VS12, GV-VS11, GV-DSP LPR, and GVLX 4 are end-of-life products with no vendor patches available. CISA recommends discontinuing use of these devices if mitigations cannot be applied.
-
If immediate replacement is not possible, isolate affected devices by removing them from internet-facing networks and placing them on segmented network zones with strict firewall rules that permit only the minimum necessary traffic from trusted management hosts.
-
Block external access to device management interfaces through perimeter firewalls and disable any port forwarding or UPnP configurations that expose device services to the internet.
-
Monitor network traffic from affected devices for indicators of compromise including connections to known botnet command-and-control infrastructure, unusual outbound traffic patterns, and scanning activity targeting other devices on the network.
-
Replace EOL GeoVision devices with currently supported alternatives from vendors that provide ongoing security updates. Implement a device lifecycle management policy that tracks firmware support status and schedules replacement before end-of-life dates.
Technical Details
CVE-2024-11120 is an OS command injection vulnerability (CWE-78) in multiple end-of-life GeoVision devices. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a maximally exploitable network vulnerability requiring no authentication or user interaction. The vulnerable devices expose web-accessible functionality that incorporates user-supplied input into operating system commands without any sanitization or input validation. An attacker can inject shell metacharacters and additional commands that execute with the privileges of the device's operating system, typically root or equivalent on embedded Linux firmware. The affected firmware versions across GV-VS12, GV-VS11, GV-DSP LPR, and GVLX 4 all share the same vulnerable code path. Since these are embedded devices running custom firmware, the command injection typically provides full root access to the underlying operating system, enabling the attacker to install persistent malware, modify device configuration, intercept video streams, and use the device as a launch point for further network attacks. The exploitation by Mirai-variant botnets demonstrates that the vulnerability is trivially automatable at scale.
Frequently Asked Questions
Is CVE-2024-11120 being actively exploited?
Yes. CVE-2024-11120 is actively exploited in Mirai-based botnet campaigns targeting GeoVision IoT devices, as documented by Akamai security research and confirmed by CISA's KEV catalog listing. The EPSS score of 66.14% at the 98th percentile reflects this intense exploitation activity.
What products are affected by CVE-2024-11120?
Affected products include the GeoVision GV-VS12, GV-VS11, GV-DSP LPR, and GVLX 4 firmware. All of these are end-of-life devices for which GeoVision no longer provides security updates or patches.
How do I fix CVE-2024-11120?
Since the affected GeoVision devices are end-of-life with no patches available, the primary remediation is to decommission and replace these devices. If immediate replacement is not feasible, isolate the devices from internet-facing networks and restrict all access through network segmentation.
How severe is CVE-2024-11120?
CVE-2024-11120 is rated Critical with a CVSS score of 9.8 out of 10, the highest severity tier. The unauthenticated remote code execution capability, combined with no available patches and active botnet exploitation, makes this an extremely high-risk vulnerability requiring immediate action.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.