Details of VAR-202406-0975

ID

VAR-202406-0975

CVE

CVE-2024-6047

TITLE

plural GeoVision In the product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-023897

DESCRIPTION

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. gv-dsp lpr firmware, GV_IPCAMD_GV_BX130 firmware, GV_IPCAMD_GV_BX1500 firmware etc. GeoVision The product has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-6047 // JVNDB: JVNDB-2024-023897

AFFECTED PRODUCTS

vendor:	geovision	model:	gv-ebl1100	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs2800	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-cb220	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-fe3401	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs04a	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs2410	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs21600	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-bx1500	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-dsp lpr	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-bx130	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-gm8186 vs14	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-efd1100	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-fd2410	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-fe420	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs2820	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gvlx 4	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs04h	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs14	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-fd3400	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-vs03	scope:	eq	version:	-	Trust: 1.0
vendor:	geovision	model:	gv-dsp lpr	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv bx1500	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv fd3400	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs04a	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs04h	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs2410	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs28xx	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs03	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv efd1100	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv ebl1100	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv fe420	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv vs216xx	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv bx130	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gvlx 4	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv cb220	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv fe3401	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv-vs14 vs14	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv ipcamd gv fd2410	scope:	-	version:	-	Trust: 0.8
vendor:	geovision	model:	gv gm8186 vs14	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-023897 // NVD: CVE-2024-6047

CVSS

SEVERITY

CVSSV2

CVSSV3

twcert@cert.org.tw:	CVE-2024-6047
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2024-023897
value:	CRITICAL
Trust: 0.8

twcert@cert.org.tw:	CVE-2024-6047
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-023897
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-023897 // NVD: CVE-2024-6047

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-023897 // NVD: CVE-2024-6047

EXTERNAL IDS

db:	NVD	id:	CVE-2024-6047	Trust: 2.6
db:	JVNDB	id:	JVNDB-2024-023897	Trust: 0.8

sources: JVNDB: JVNDB-2024-023897 // NVD: CVE-2024-6047

REFERENCES

url:	https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html	Trust: 1.8
url:	https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html	Trust: 1.8
url:	https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet	Trust: 1.8
url:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2024-6047	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-6047	Trust: 0.8
url:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog	Trust: 0.8

sources: JVNDB: JVNDB-2024-023897 // NVD: CVE-2024-6047

SOURCES

db:	JVNDB	id:	JVNDB-2024-023897
db:	NVD	id:	CVE-2024-6047

LAST UPDATE DATE

2025-11-18T15:30:25.488000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-023897	date:	2025-05-16T07:47:00
db:	NVD	id:	CVE-2024-6047	date:	2025-10-30T19:23:34.360

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-023897	date:	2025-05-16T00:00:00
db:	NVD	id:	CVE-2024-6047	date:	2024-06-17T06:15:09.237