9.8

CVE-2024-6047

Warning
Exploit

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Data is provided by the National Vulnerability Database (NVD)
Geovision ≫ Gv-dsp Lpr Firmware Version-
   Geovision ≫ Gv-dsp Lpr Version2.0
Geovision ≫ Gv Gm8186 Vs14 Firmware Version-
   Geovision ≫ Gv Gm8186 Vs14 Version-
Geovision ≫ Gv-vs14 Vs14 Firmware Version-
   Geovision ≫ Gv-vs14 Vs14 Version-
Geovision ≫ Gv Vs03 Firmware Version-
   Geovision ≫ Gv Vs03 Version-
Geovision ≫ Gv Vs2410 Firmware Version-
   Geovision ≫ Gv Vs2410 Version-
Geovision ≫ Gv Vs216xx Firmware Version-
   Geovision ≫ Gv Vs216xx Version-
Geovision ≫ Gv Vs04a Firmware Version-
   Geovision ≫ Gv Vs04a Version-
Geovision ≫ Gv Vs04h Firmware Version-
   Geovision ≫ Gv Vs04h Version-
Geovision ≫ Gvlx 4 Firmware Version-
   Geovision ≫ Gvlx 4 Version2.0
   Geovision ≫ Gvlx 4 Version3.0

07.05.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

GeoVision Devices OS Command Injection Vulnerability

Vulnerability

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands.

Description

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 74.88% 0.988
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
twcert@cert.org.tw 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.