{"id":"CVE-2024-11120","published":"2024-11-15T02:15:17Z","modified":"2026-06-17T06:57:06Z","title":"GeoVision Devices OS Command Injection Vulnerability","vendor":"GeoVision","product":"Multiple Devices","tier":"core","eol":null,"description":{"text":"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.","provenance":"source","from":"NVD"},"summary":{"text":"GeoVision end-of-life devices contain an OS command injection flaw, classified as improper neutralization of special elements used in an OS command, affecting multiple GeoVision products. An unauthenticated remote attacker with network access can exploit it without user interaction or special configuration to inject and execute arbitrary system commands on the affected device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.28386,"percentile":0.98119,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-05-07","dueDate":"2025-05-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-11120","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-15","exploitedFirstSeen":"2024-11-15","ransomware":false,"evidence":[{"url":"https://www.bleepingcomputer.com/news/security/botnet-exploits-geovision-zero-day-to-install-mirai-malware/","date":"2024-11-15"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11120","date":"2024-11-15"},{"url":"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html","date":"2024-11-15"},{"url":"https://x.com/Shadowserver/status/1857356335605530952","date":"2024-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-06&host_type=src&vulnerability=cve-2024-11120","date":"2025-04-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-07&host_type=src&vulnerability=cve-2024-11120","date":"2025-04-07"},{"url":"https://www.akamai.com/blog/security-research/2025/may/active-exploitation-mirai-geovision-iot-botnet","date":"2025-05-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-05-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-26&host_type=src&vulnerability=cve-2024-11120","date":"2025-05-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-27&host_type=src&vulnerability=cve-2024-11120","date":"2025-05-27"}],"evidenceTotal":67,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html","tags":["Third Party Advisory"]},{"url":"https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html","tags":["Third Party Advisory"]},{"url":"https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system.","confidence":"high"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system. This leads to denial of service.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-33664","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33664","exploited":true,"exploitedSince":"2025-05-07","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1498"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2024-11-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11120","provenance":"source"},{"date":"2024-11-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.bleepingcomputer.com/news/security/botnet-exploits-geovision-zero-day-to-install-mirai-malware/","provenance":"source"},{"date":"2025-05-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-05-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33664","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":173},"priority":{"score":69.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 714 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9812"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}