CVE-2024-6047 is an OS command injection vulnerability in a set of discontinued GeoVision IP cameras, DVRs, video servers and license-plate-recognition units: because the devices fail to sanitize a parameter in a device-configuration CGI endpoint, an unauthenticated remote attacker can inject and run arbitrary system commands, and since the affected models are end-of-life GeoVision has not shipped a patch — it instead recommends retiring the hardware, while a Mirai-based botnet has been actively exploiting the flaw to recruit the devices.
Vulnerability summary
9.8
Critical
10.1%
EPSS score (FIRST)
Yes
CISA KEV catalog
2024-06-17
Published
Vulnerability ID: CVE-2024-6047 · Source: TWCERT/CC (CNA Secondary score; NVD has not published its own Primary CVSS as of this check — not NVD-confirmed). Confirmed present in the live CISA KEV catalog.
Affected components
| Component | CPE | Version range |
|---|---|---|
| GeoVision end-of-life IP cameras, DVRs, video servers and LPR units (multiple models, incl. GV-BX130, GV-BX1500, GV-CB220, GV-EBL1100, GV-EFD1100, GV-FD2410, GV-FD3400, GV-FE3401, GV-FE420, GV-VS03/04A/04H/14/2410/28XX/216XX, GV-DSP_LPR, GVLX 4 V2/V3) | cpe:2.3:o:geovision:gv-bx130_firmware:-:*:*:*:*:*:*:* | All firmware versions on the listed end-of-life/end-of-service models; no fix is available — GeoVision's advisory states the products are no longer supported and recommends retiring the devices |
What this means
CVE-2024-6047 is an OS command injection vulnerability (CWE-78) in a range of discontinued GeoVision IP video-surveillance devices. Per NVD: "Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device" (NVD).
As of this check, NVD's vulnerability status is "Analyzed" (NVD has added CPE/configuration data for the affected models) but NVD has not published its own independent Primary CVSS metric; the only score on record is a Secondary submission from Taiwan's TWCERT/CC (source [email protected]): CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD). Per our indexing policy, this 9.8 figure is labelled not NVD-confirmed rather than attributed to NVD; this page stays indexed on the basis of the CVE's genuine, independently-verified presence in the live CISA KEV catalog, not an NVD-confirmed score.
TWCERT's own advisory (tracking ID TVN-202406015, published 2024-06-17) lists the affected models — including the GV-DSP_LPR license-plate-recognition unit, multiple GV-BX/CB/EBL/EFD/FD/FE IP camera lines, several GV-VS video-server models, and the GVLX 4 V2/V3 DVR — and states plainly that "the product is no longer in support. Please retire affected device," meaning no firmware patch is being issued (TWCERT Security Advisory).
CISA added CVE-2024-6047 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-05-07, due date 2025-05-28, alongside the related CVE-2024-11120 affecting the same device family; the KEV entry notes the "impacted products could be end-of-life (EoL) and/or end-of-service (EoS)" and that "users should discontinue product utilization," with known ransomware-campaign use listed as "Unknown" (catalog version 2026.10.29, 1764 entries, confirmed live this run) (CISA KEV).
Akamai's security research team documented active, ongoing exploitation of both CVE-2024-6047 and CVE-2024-11120 by a Mirai-variant botnet: the attack targets the /DateSetting.cgi endpoint's szSrvIpAddr parameter to inject commands that download an ARM-based Mirai payload (an "LZRD"-family variant Akamai refers to as "boatnet") from attacker-controlled infrastructure, after which the device joins the botnet's command-and-control network; the same campaign infrastructure chains into other IoT and router exploits (Akamai — Active Exploitation of a Mirai Variant Targeting GeoVision EOL Devices).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.10072 (95.618th percentile) — notably elevated for an EOL device line, consistent with ongoing botnet scanning and exploitation documented by Akamai (FIRST EPSS).
Because no patch exists, any of the affected GeoVision models reachable from the internet or an untrusted network should be taken offline and replaced; where immediate replacement isn't possible, isolate the devices behind a firewall that blocks inbound access to their management CGI interface.
Evidence
- Certain EOL GeoVision devices fail to properly filter user input, allowing unauthenticated remote attackers to inject and execute arbitrary system commands. — NVD
- CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by TWCERT/CC as a Secondary score; NVD's vulnStatus is Analyzed but NVD has not published its own Primary CVSS as of this check. — NVD
- Affected models (TVN-202406015) include GV-DSP_LPR, multiple GV-BX/CB/EBL/EFD/FD/FE camera lines, several GV-VS video servers, and GVLX 4 V2/V3; the products are end-of-life with no patch — vendor recommends retiring the devices. — TWCERT Security Advisory
- Added to the CISA KEV catalog on 2025-05-07, due date 2025-05-28; CISA notes the products are EoL/EoS and recommends discontinuing use. — CISA KEV
- A Mirai-variant botnet actively exploits CVE-2024-6047 and CVE-2024-11120 via the /DateSetting.cgi szSrvIpAddr parameter to deploy an ARM Mirai payload and recruit devices into a C2 network. — Akamai — Active Exploitation of a Mirai Variant Targeting GeoVision EOL Devices
- EPSS score is 0.10072 (95.618th percentile) as of 2026-10-29. — FIRST EPSS
