CVE-2024-6047: GeoVision EOL devices OS command injection via unfiltered input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated remote command execution, active exploitation referenced, and CISA KEV listing make this a critical priority.

What it is

Certain end-of-life GeoVision devices fail to filter user input in a specific function, allowing OS command injection. Unauthenticated remote attackers can execute arbitrary system commands on the device. Because the affected products are EOL, patches may not exist, raising the risk for exposed deployments.

Impact

An attacker gains arbitrary command execution with the privileges of the vulnerable service, enabling full device compromise, data theft, or use in a botnet.

Attack surface

Reachable over the network via the vulnerable functionality; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.

Exploitation

Listed in CISA KEV with a 2025-05-07 addition, and an Akamai reference tagged Exploit describes active Mirai botnet exploitation; EPSS 30-day probability is about 10.1% (95th percentile).

What to do

• Apply vendor mitigations or firmware updates if available; if not, discontinue use of the affected EOL devices per CISA guidance.
• Remove or isolate affected GeoVision devices from the public internet; restrict access to trusted networks only.
• Place devices behind a firewall or VPN and block unnecessary inbound access to management and service ports.
• Monitor vendor and CISA advisories for updated guidance, and plan replacement of EOL hardware.
• If devices must remain, enforce network segmentation and least-privilege access to limit lateral movement.

Detection

• Monitor device and network logs for unexpected outbound connections or command execution patterns indicative of Mirai-like botnet activity.
• Alert on inbound requests to GeoVision device management or service endpoints from untrusted sources.
• Use network monitoring to detect anomalous traffic from GeoVision devices to known C2 or scanning infrastructure.
• Audit exposed GeoVision devices for signs of compromise, such as modified configurations or unexpected processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.