CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-05-07. EPSS: 10.1% chance of exploitation in the next 30 days.

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Affected products

• GeoVision Gv-BX130 Firmware: affected versions not specified
• GeoVision Gv-BX1500 Firmware: affected versions not specified
• GeoVision Gv-CB220 Firmware: affected versions not specified
• GeoVision Gv-Dsp Lpr Firmware: affected versions not specified
• GeoVision Gv-EBL1100 Firmware: affected versions not specified
• GeoVision Gv-EFD1100 Firmware: affected versions not specified
• GeoVision Gv-FD2410 Firmware: affected versions not specified
• GeoVision Gv-FD3400 Firmware: affected versions not specified
• GeoVision Gv-FE3401 Firmware: affected versions not specified
• GeoVision Gv-FE420 Firmware: affected versions not specified
• GeoVision Gv-GM8186 VS14 Firmware: affected versions not specified
• GeoVision Gv-VS03 Firmware: affected versions not specified
• GeoVision Gv-VS04A Firmware: affected versions not specified
• GeoVision Gv-VS04H Firmware: affected versions not specified
• GeoVision Gv-VS14 Firmware: affected versions not specified
• GeoVision Gv-VS21600 Firmware: affected versions not specified
• GeoVision Gv-VS2410 Firmware: affected versions not specified
• GeoVision Gv-VS2800 Firmware: affected versions not specified
• GeoVision Gv-VS2820 Firmware: affected versions not specified
• GeoVision Gvlx 4 Firmware: affected versions not specified

Published 2024-06-17. Last modified 2026-06-17.