CVE-2024-6047
GeoVision Devices OS Command Injection Vulnerability
Description
CVE-2024-6047 is a critical OS command injection vulnerability in a wide range of end-of-life GeoVision devices, including video servers, IP cameras, and network video recorders. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the affected devices by exploiting insufficient input filtering in specific device functionality. With a CVSS v3.1 base score of 9.8 (Critical), this vulnerability affects over 20 different GeoVision device models. CISA added CVE-2024-6047 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 28, 2025, and its EPSS score of 72.97% at the 98th percentile confirms massive active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| geovision | gv-dsp lpr firmware | - |
| geovision | gv-bx130 firmware | - |
| geovision | gv-bx1500 firmware | - |
| geovision | gv-cb220 firmware | - |
| geovision | gv-ebl1100 firmware | - |
| geovision | gv-efd1100 firmware | - |
| geovision | gv-fd2410 firmware | - |
| geovision | gv-fd3400 firmware | - |
| geovision | gv-fe3401 firmware | - |
| geovision | gv-fe420 firmware | - |
| geovision | gv-gm8186 vs14 firmware | - |
| geovision | gv-vs14 firmware | - |
| geovision | gv-vs03 firmware | - |
| geovision | gv-vs2410 firmware | - |
| geovision | gv-vs21600 firmware | - |
| geovision | gv-vs04a firmware | - |
| geovision | gv-vs04h firmware | - |
| geovision | gvlx 4 firmware | - |
| geovision | gv-vs2800 firmware | - |
| geovision | gv-vs2820 firmware | - |
References
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html(Third Party Advisory)
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html(Third Party Advisory)
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6047(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2024-6047 is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command. This weakness exists when user-controllable input is incorporated into operating system commands without proper sanitization of shell metacharacters. In the affected GeoVision devices, a specific web-accessible functionality fails to adequately filter user input, allowing attackers to inject commands that the device executes at the system level with full device privileges.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2024-6047 carries a maximum-tier CVSS v3.1 score of 9.8 (Critical), reflecting the worst-case exploitation scenario. The vulnerability is remotely exploitable (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). All three CIA dimensions face high impact: confidentiality is fully compromised as attackers gain access to video feeds, stored recordings, device credentials, and potentially network-wide credentials stored on the devices. Integrity is at maximum risk because the attacker can modify device firmware, alter configurations, inject persistent backdoors, and tamper with recorded surveillance footage. Availability faces high impact through device bricking, service disruption, and resource consumption from botnet enrollment. The attack surface is exceptionally broad, spanning over 20 different GeoVision device models including the GV-DSP LPR, GV-BX series, GV-CB220, GV-EBL1100, GV-EFD1100, GV-FD series, GV-FE series, GV-VS series, and GVLX 4 platforms. The EPSS score of 72.97% at the 98th percentile confirms this vulnerability is among the most aggressively exploited in the current threat landscape.
Exploit Maturity
CVE-2024-6047 has reached maximum exploit maturity with widespread active exploitation confirmed by multiple sources. Public exploit analysis is available via Akamai's research on active exploitation of GeoVision IoT devices in Mirai botnet campaigns, documenting the automated mass exploitation of these devices. CISA confirmed active exploitation by adding CVE-2024-6047 to the Known Exploited Vulnerabilities catalog on May 7, 2025. The EPSS score of 72.97% at the 98th percentile, one of the highest scores observed, indicates near-certain exploitation for any exposed device. The vulnerability is being actively weaponized by Mirai-variant botnets that scan for and automatically compromise vulnerable GeoVision devices at scale, converting them into DDoS attack nodes.
Remediation
-
Decommission all affected GeoVision devices immediately. With over 20 affected models, all end-of-life and unsupported, no vendor patches exist. CISA recommends discontinuing use if no mitigations are available.
-
Remove affected devices from internet-accessible networks as the highest-priority interim measure. Ensure no port forwarding, UPnP, or other network configurations expose device interfaces to the internet.
-
Implement strict network segmentation by placing any GeoVision devices that cannot be immediately replaced on isolated network segments with firewall rules permitting only essential management traffic from specific trusted hosts.
-
Scan networks for unauthorized GeoVision devices that may have been deployed outside of IT management oversight. Shadow IoT devices are a common attack surface that may be running vulnerable firmware without organizational awareness.
-
Replace affected devices with currently supported surveillance equipment that receives regular firmware updates. Establish an IoT asset inventory and lifecycle management program that tracks device support status and proactively schedules replacements before end-of-life.
Technical Details
CVE-2024-6047 is an OS command injection vulnerability (CWE-78) affecting a broad range of end-of-life GeoVision surveillance and video equipment. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms this as an unauthenticated remote command execution vulnerability with maximum exploitability and impact. The vulnerability exists in specific web-accessible functionality present across more than 20 GeoVision device models, where the firmware fails to properly filter user input before incorporating it into system-level command execution. The affected devices, running embedded Linux firmware, execute injected commands with root privileges, granting complete control over the device. The broad range of affected models, including the GV-BX, GV-CB, GV-EBL, GV-EFD, GV-FD, GV-FE, GV-VS, and GVLX product lines, suggests the vulnerable code exists in a shared firmware component or library common to GeoVision's product portfolio. The exploitation technique is straightforward and highly automatable, as demonstrated by its integration into Mirai-variant botnet infrastructure that performs internet-wide scanning and automated exploitation of discovered devices.
Frequently Asked Questions
Is CVE-2024-6047 being actively exploited?
Yes. CVE-2024-6047 is under massive active exploitation by Mirai-variant botnets, as documented by Akamai security research. CISA added it to the KEV catalog on May 7, 2025. The EPSS score of 72.97% at the 98th percentile confirms this is one of the most actively exploited vulnerabilities tracked.
What products are affected by CVE-2024-6047?
Over 20 GeoVision device models are affected, including GV-DSP LPR, GV-BX130, GV-BX1500, GV-CB220, GV-EBL1100, GV-EFD1100, GV-FD2410, GV-FD3400, GV-FE3401, GV-FE420, GV-VS03, GV-VS04A, GV-VS04H, GV-VS14, GV-VS2410, GV-VS21600, GV-VS2800, GV-VS2820, GVLX 4, and GV-GM8186 VS14. All are end-of-life products.
How do I fix CVE-2024-6047?
No patches are available as all affected GeoVision devices are end-of-life. The recommended action is to decommission and replace these devices. If immediate replacement is not possible, remove them from internet-facing networks and implement strict network segmentation.
How severe is CVE-2024-6047?
CVE-2024-6047 is rated Critical with a maximum-tier CVSS score of 9.8, reflecting unauthenticated remote command execution with full system compromise. The 72.97% EPSS score confirms it is among the most aggressively targeted vulnerabilities in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.