CVE-2024-11120: GeoVision EOL Devices OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation confirmed by CISA KEV and Akamai, unauthenticated remote code execution, and high EPSS score make this an urgent risk.

What it is

Certain end-of-life GeoVision devices contain an OS command injection flaw (CWE-78) that allows unauthenticated remote attackers to execute arbitrary system commands. The vulnerability affects multiple GeoVision firmware products and has been actively exploited in the wild, making it a serious risk for any remaining deployments.

Impact

An attacker can execute arbitrary system commands on the device, leading to full compromise of confidentiality, integrity, and availability. This can enable botnet recruitment, data theft, or use of the device as a pivot point into the network.

Attack surface

The flaw is reachable over the network with no authentication or user interaction required, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet-exposed or network-accessible GeoVision device running the affected firmware is a potential target.

Exploitation

Exploitation has been confirmed: the CVE is listed in CISA KEV (added 2025-05-07) and an Akamai report documents active exploitation by Mirai botnet. EPSS probability is 0.28386 (98th percentile), indicating high likelihood of exploitation.

What to do

• Apply vendor-provided mitigations or firmware updates if available; if the device is end-of-life and no patch exists, discontinue use or isolate it from untrusted networks.
• Remove or block internet exposure of affected GeoVision devices; place them behind a firewall and restrict access to trusted management networks only.
• Follow CISA BOD 22-01 guidance for cloud services and apply the required actions from the KEV catalog by the due date (2025-05-28).
• Monitor for signs of compromise and consider replacing EOL devices with supported alternatives.

Detection

• Monitor network traffic for command injection attempts targeting GeoVision device endpoints, looking for unusual HTTP requests containing shell metacharacters.
• Inspect device logs for unexpected command execution, new processes, or outbound connections to known botnet C2 infrastructure.
• Use network segmentation and IDS/IPS signatures to detect exploitation attempts against GeoVision devices.
• Audit network for any internet-facing GeoVision devices and verify they are not running vulnerable firmware versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.