CVE-2024-11120 GeoVision Devices OS Command Injection
Unauthenticated attackers can execute arbitrary system commands on GeoVision LPR devices, which are end-of-life and actively exploited.
- Exploited in the wild
- Since 7 May 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11120?
CVE-2024-11120 is a critical command injection vulnerability in GeoVision GV-DSP_LPR_V3, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
Weakness: CWE-78
Which versions are affected by CVE-2024-11120?
It affects 4 products.
Products include Geovision Gv-Dsp Lpr Firmware, Geovision Gv-Vs11 Firmware, Geovision Gv-Vs12 Firmware, Geovision Gvlx 4 Firmware.
How do I fix CVE-2024-11120?
No fix has been published for CVE-2024-11120 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 May 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-11120 being exploited?
Yes. Attackers have exploited CVE-2024-11120 in the wild since at least 7 May 2025.
Sources
Also known as GHSA-hq2j-jpv4-q865.