CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Other sources
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GeoVision Devices OS Command Injection Vulnerability (EOL GeoVision devices)from your environment.Retire or replace the impacted EOL GeoVision devices because they contain an OS command injection vulnerability allowing remote, unauthenticated command execution.
- Compensating control
Discontinue product utilization for affected GeoVision devices when mitigations are unavailable (and otherwise apply mitigations per vendor instructions, including applicable BOD 22-01 guidance for cloud services).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6047?
CVE-2024-6047 has been classified as a high severity vulnerability due to the potential for unauthenticated remote code execution.
How do I fix CVE-2024-6047?
To mitigate CVE-2024-6047, update your GeoVision EOL device to the latest firmware version that addresses this vulnerability.
Who is affected by CVE-2024-6047?
The CVE-2024-6047 vulnerability affects certain end-of-life (EOL) GeoVision devices that do not properly filter user inputs.
What kind of attacks can be executed using CVE-2024-6047?
CVE-2024-6047 allows unauthenticated remote attackers to inject and execute arbitrary system commands on the affected GeoVision devices.
Is authentication required to exploit CVE-2024-6047?
No, CVE-2024-6047 can be exploited by attackers without authentication, making it particularly dangerous.