CVE-2024-6047

An attacker can submit crafted input data to a vulnerable device function without any authentication. Due to lack of proper input validation and filtering (CWE-78 — OS Command Injection), injected commands are executed directly by the device's operating system. The attack is possible remotely over the network, requires no user interaction or any privileges.

An attacker gains the ability to execute arbitrary system commands on the device, which in practice means full control over the device, loss of data confidentiality, possibility of configuration modification, and inclusion of the device in a botnet.

Devices affected by the vulnerability have EOL status and will most likely not receive official patches from the manufacturer. Immediate replacement of devices with supported models is recommended. Until replacement, devices should be isolated from the public network, restrict access through a firewall to trusted IP addresses only, and monitor network traffic for anomalies. Detailed recommendations are available in TWCERT bulletins at the addresses indicated in the references.

GeoVision EOL devices: GV-DSP LPR (firmware), GV-BX130 (firmware), GV-BX1500 (firmware) and their corresponding hardware models — according to manufacturer and TWCERT references.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.