GeoVision OS Command Injection (CVE-2024-11120)

Historical catalog analysis: CISA added this entry on May 07, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-11120 is an OS command injection vulnerability (CWE-78) affecting multiple GeoVision devices. The flaw allows a remote, unauthenticated attacker to inject and execute arbitrary system commands on the affected hardware. Because this occurs without authentication, the vulnerability presents a high risk of unauthorized system access.

Exposure and applicability

This vulnerability applies to various GeoVision devices. A critical factor for infrastructure owners is that some impacted products may be end-of-life (EoL) or end-of-service (EoS). This means that traditional patching cycles may not be available for all deployed assets, increasing the likelihood that legacy hardware remains exposed.

Remediation priorities

Based on our analysis of the vulnerability’s nature and the status of affected hardware, we recommend the following prioritization:

1. Asset Identification: Inventory all GeoVision devices across the network to determine which models are deployed and their current support status (Active vs. EoL/EoS).
2. Vendor Mitigation Application: For supported devices, apply mitigations according to vendor instructions immediately.
3. Decommissioning Legacy Hardware: For assets identified as EoL or EoS where no mitigation is available, the priority should be the discontinuation of product utilization to eliminate the attack surface.
4. Network Isolation: As a compensating control while patching or decommissioning occurs, restrict network access to these devices to trusted management segments only, reducing the possibility of remote unauthenticated access.

How to validate remediation

Verification must move beyond simple version checks, as a version number does not prove that a mitigation is active or effective. Defenders should use the following methods:

• Configuration Audit: Verify that vendor-recommended configuration changes or patches have been applied and are persisting after device reboots.
• Access Control Validation: Confirm via firewall logs or network scans that the devices are no longer reachable from untrusted zones, limiting the exposure path for unauthenticated attackers.
• Decommissioning Evidence: Maintain a record of decommissioned EoL/EoS hardware to ensure they have been physically or logically removed from the environment.

Limits and open questions

There is residual risk associated with devices that are patched but remain exposed to the network, as other undiscovered vulnerabilities may exist. It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, because some devices are EoL/EoS, there is a risk that no official fix exists for certain hardware versions, leaving decommissioning as the only viable path for total exposure reduction.

Source and editorial note

CVE-2024-11120: GeoVision Devices OS Command Injection Vulnerability · Source date: May 07, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 10, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 15, 2026 at 00:48 UTC.

Request a Vulnerability Assessment