U.S. CISA adds GoVision device flaws to its Known Exploited Vulnerabilities catalog

Multiple GeoVision devices contain an unauthenticated OS command injection flaw (CWE-78) that allows a remote attacker to inject and execute arbitrary system commands on the device. Because no authentication is required, any party that can reach an affected device's network services can trigger the flaw with crafted input; no public proof-of-concept is known. Successful exploitation gives the attacker remote command execution on the device, which can be used to compromise surveillance infrastructure or pivot into connected networks. Organizations running GeoVision devices are affected, and CISA notes the impacted products may be end-of-life (EoL) and/or end-of-service (EoS), meaning some may no longer receive fixes. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-07, confirming exploitation in the wild; EPSS estimates a 28.4% probability of exploitation in the next 30 days (98th percentile), and ransomware use is not yet confirmed.

Do: Inventory all GeoVision devices (including EoL/EoS models) and consult the vendor advisory for affected models and any available firmware mitigations or patches. Restrict internet exposure of GeoVision devices while remediating (firewall rules/ACLs, remove direct port forwarding), and replace or retire EoL/EoS units if the vendor offers no mitigation. Because the flaw is confirmed exploited in the wild, check devices for signs of compromise and unusual outbound traffic.

CVE-2024-6047 is an unauthenticated OS command injection flaw (CWE-78) in certain end-of-life GeoVision surveillance devices, which fail to properly filter user input for a specific functionality. A remote attacker can trigger it by sending crafted input to the affected device over the network with no authentication required, causing arbitrary system commands to be injected and executed on the device. Successful exploitation grants attackers control of the device, which has been leveraged to recruit GeoVision units into Mirai botnets. Organizations still running the listed EOL GeoVision devices (e.g., GV-BX, GV-CB, GV-EBL, GV-EFD, GV-FD, GV-FE series devices, GV-DSP LPR units, and GV-VS14/GV-GM8186 VS14 units) are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-07, Akamai has documented active Mirai-based exploitation, and EPSS puts the 30-day exploitation probability at about 10%.

Do: Inventory internet-facing GeoVision devices, identify the listed EOL models, and apply mitigations per vendor instructions (e.g., restrict web/management access to trusted networks) or discontinue use and replace the devices if mitigations are unavailable, since the affected devices are end-of-life. US federal agencies must remediate per BOD 22-01 following the KEV listing. Given active Mirai botnet exploitation and ~10% EPSS, prioritize devices exposed to the internet and check for anomalous outbound traffic consistent with botnet activity.