Critical 9.8Known exploited (CISA KEV)Published Nov 14, 2024

CVE-2024-11120GeoVision EOL devices - OS Command Injection

Updated under an hour ago (Oct 28, 2026, 4:10 AM ET)

Does this affect you?

It affects GeoVision GV-VS12 and 11 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 7, 2025; federal agencies had to remediate by May 28, 2025. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for GeoVision GV-VS12

Exploited in the last 30 days

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV May 7, 2025; federal remediation due May 28, 2025Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 28.39% (percentile 98)
Assigned by: twcert
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

GeoVision GV-VS12 geovision:gv_vs12 (from the name)	0	CNA record
GeoVision GV-VS11 geovision:gv_vs11 (from the name)	0	CNA record
GeoVision GV-DSP_LPR_V3 geovision:gv_dsp_lpr_v3 (from the name)	0	CNA record
GeoVision GVLX 4 V2 geovision:gvlx_4_v2 (from the name)	0	CNA record
GeoVision GVLX 4 V3 geovision:gvlx_4_v3 (from the name)	0	CNA record
geovision gv-vs12_firmware geovision:gv-vs12_firmware	all versions	CISA ADP
geovision gv-vs11_firmware geovision:gv-vs11_firmware	all versions	CISA ADP
geovision gv-dsp_lpr_v3_firmware geovision:gv-dsp_lpr_v3_firmware	all versions	CISA ADP
geovision gvlx_4_v2_firmware geovision:gvlx_4_v2_firmware	all versions	CISA ADP
geovision gvlx_4_v3_firmware geovision:gvlx_4_v3_firmware	all versions	CISA ADP
1–10 of 14

References

References

https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html	third-party-advisory
https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html	third-party-advisory
https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet	exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11120	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.