CVE-2024-11120 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2024-11-15

Added to CISA KEV: 2025-05-07 173 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
IMMEDIATE: Disconnect affected GeoVision devices from internet exposure until replacement
Implement network segmentation to isolate affected devices from internet access
Monitor network traffic for suspicious command injection attempts
Replace end-of-life devices as vendor recommends - no patches will be released

CVE-2024-11120 is a critical security vulnerability affecting certain end-of-life (EOL) GeoVision IoT surveillance devices ^[2].

Type: OS Command Injection ^[1].
Root Cause: The vulnerability stems from insufficient input validation within the affected devices ^[2].
Impact: Successful exploitation allows an unauthenticated, remote attacker to inject and execute arbitrary system commands on the target device ^[1] ^[2].

Active Exploitation: This vulnerability is included in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog, indicating that it is being actively exploited in the wild ^[1].
Requirements: Exploitation is remote and does not require authentication or user interaction ^[1] ^[2].

Affected Products: The vulnerability affects various EOL GeoVision IoT surveillance devices, including the DSP LPR, Video Server, and DVR product lines ^[2].
Status: Because these devices are end-of-life, they no longer receive security updates or patches from the manufacturer. Users are generally advised to replace these devices or isolate them from the network to mitigate the risk of exploitation. Further guidance can be found by consulting CISA’s Binding Operational Directive (BOD) 22-01 and the Known Exploited Vulnerabilities Catalog ^[1].

CVE-2024-11120 Detail - NVD
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute ... This CVE is in CISA's Known Exploited Vulnerabilities Catalog Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for…
EOL GeoVision devices - OS Command Injection vulnerability - Armis
CVE-2024-11120 is a critical OS Command Injection vulnerability affecting certain end-of-life (EOL) GeoVision IoT surveillance devices. ... CVE-2024-11120 is a critical OS Command Injection vulnerability affecting certain end-of-life (EOL) GeoVision IoT surveillance devices, including the DSP LPR, V…

🔴 CVE-2024-11120