CVEs / CVE-2024-6047
CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability
- Known exploited in the CISA KEV catalog since 7 May 2025
- critical 9.8 CVSS 3.1 (from the CNA)
- EPSS 10% chance of exploitation in the next 30 days, higher than 95% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-6047
Summary
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Description
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| GeoVision GV_DSP_LPR_V2 | all | — |
| GeoVision GV_IPCAMD_GV_BX1500 | all | — |
| GeoVision GV_IPCAMD_GV_CB220 | all | — |
| GeoVision GV_IPCAMD_GV_EBL1100 | all | — |
| GeoVision GV_IPCAMD_GV_EFD1100 | all | — |
| GeoVision GV_IPCAMD_GV_FD2410 | all | — |
| GeoVision GV_IPCAMD_GV_FD3400 | all | — |
| GeoVision GV_IPCAMD_GV_FE3401 | all | — |
| GeoVision GV_IPCAMD_GV_FE420 | all | — |
| GeoVision GV-VS14_VS14 | all | — |
| GeoVision GV_VS03 | all | — |
| GeoVision GV_VS2410 | all | — |
| GeoVision GV_VS28XX | all | — |
| GeoVision GV_VS216XX | all | — |
| GeoVision GV VS04A | all | — |
| GeoVision GV VS04H | all | — |
| GeoVision GVLX 4 V2 | all | — |
| GeoVision GVLX 4 V3 | all | — |
| GeoVision GV_IPCAMD_GV_BX130 | all | — |
| GeoVision GV_GM8186_VS14 | all | — |
| geovision gv-dsp_lpr_v2 | all versions | — |
| geovision gv-bx1500 | all versions | — |
| geovision gv-cb220 | all versions | — |
| geovision gv-ebl1100 | all versions | — |
| geovision gv-efd1100 | all versions | — |
| geovision gv-fd2410 | all versions | — |
| geovision gv-fd3400 | all versions | — |
| geovision gv-fd3401 | all versions | — |
| geovision gv-fe420 | all versions | — |
| geovision gv-vs14 | all versions | — |
Exploitation
| In CISA KEV since | 7 May 2025 |
|---|---|
| Due date for US federal agencies | 28 May 2025 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-78 |
References
- CVE-2024-6047 on NVD
- CVE-2024-6047 in the CISA KEV catalog
- https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf (cited by CISA)
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html Third Party Advisory
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6047 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.