^{CVE-2024-11120:}CVE-2024-11120 is an unauthenticated OS command injection vulnerability affecting select end-of-life GeoVision devices (GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, GVLX 4 V3).

This vulnerability (CWE-78 OS Command Injection) allows unauthenticated remote attackers to inject and execute arbitrary operating-system commands on affected GeoVision devices. The flaw has a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no privileges required, and no user interaction, enabling attacker-controlled commands that impact confidentiality, integrity, and availability. The affected devices are end-of-life and no longer maintained by the vendor, and there are reports indicating that exploitation has already occurred in the wild. No patch is available for these devices; remediation guidance centers on decommissioning and replacing the devices. See the associated TWCERT advisories and related analyses for details.

Overview

This advisory describes an OS command injection vulnerability in several end-of-life GeoVision devices, enabling unauthenticated remote command execution with high impact. The vulnerability has been observed in active exploitation and affects multiple GeoVision products that are no longer maintained, underscoring the urgency of replacing affected hardware rather than awaiting fixes.

Remediation

• Replace the affected devices with supported, maintained hardware as recommended by the advisory (the devices are no longer maintained and replacement is advised).
• If replacement is not immediately feasible, implement strong network controls:
  • Isolate devices from untrusted networks and the internet.
  • Restrict management interfaces to trusted networks only (use VPNs or jump hosts).
  • Enforce strict firewall rules to block inbound/outbound traffic to/from the devices except for approved management paths.
• Disable or minimize exposed services and management features on the devices where possible.
• Conduct inventory and confirm which devices in your environment are in the affected list (GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, GVLX 4 V3) and plan replacement.
• Enhance monitoring and detection:
  • Enable and review device logs for anomalous command execution attempts.
  • Monitor for unusual outbound traffic or botnet-related activity consistent with IoT compromises.
  • Leverage network-based IDS/IPS rules to detect exploitation indicators where feasible.
• If a temporary workaround exists from the vendor or integrator, apply any documented mitigations, but treat replacement as the primary remediation path.
• Review and implement a decommissioning plan for EOL devices to minimize risk exposure across the environment.

References

• TWCERT Taiwan advisory (Japanese/English pages): https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html
• TWCERT English advisory: https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html
• Akamai security blog on exploitation: https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
• CISA Known Exploited Vulnerabilities (KEV) feed reference: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json