Veille CVE
CVE-2024-6047
9.8 Critique Exploitée activementCatalogue CISA KEV — GeoVision Devices OS Command Injection Vulnerability
Ajoutée le 07/05/2025 · Échéance de correction (agences US) : 28/05/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Produits concernés
- GeoVision GV_DSP_LPR_V2
- GeoVision GV_IPCAMD_GV_BX1500
- GeoVision GV_IPCAMD_GV_CB220
- GeoVision GV_IPCAMD_GV_EBL1100
- GeoVision GV_IPCAMD_GV_EFD1100
- GeoVision GV_IPCAMD_GV_FD2410
- GeoVision GV_IPCAMD_GV_FD3400
- GeoVision GV_IPCAMD_GV_FE3401
- GeoVision GV_IPCAMD_GV_FE420
- GeoVision GV-VS14_VS14
- GeoVision GV_VS03
- GeoVision GV_VS2410
- GeoVision GV_VS28XX
- GeoVision GV_VS216XX
- GeoVision GV VS04A
- GeoVision GV VS04H
- GeoVision GVLX 4 V2
- GeoVision GVLX 4 V3
- GeoVision GV_IPCAMD_GV_BX130
- GeoVision GV_GM8186_VS14
- geovision gv-dsp_lpr_v2
- geovision gv-bx1500
- geovision gv-cb220
- geovision gv-ebl1100
- geovision gv-efd1100
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | twcert@cert.org.tw | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html Third Party Advisory
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html Third Party Advisory
- https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6047 US Government Resource