CVE-2024-6047

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
GeoVisionGV_DSP_LPR_V2all
GeoVisionGV_IPCAMD_GV_BX1500all
GeoVisionGV_IPCAMD_GV_CB220all
GeoVisionGV_IPCAMD_GV_EBL1100all
GeoVisionGV_IPCAMD_GV_EFD1100all
GeoVisionGV_IPCAMD_GV_FD2410all
GeoVisionGV_IPCAMD_GV_FD3400all
GeoVisionGV_IPCAMD_GV_FE3401all
GeoVisionGV_IPCAMD_GV_FE420all
GeoVisionGV-VS14_VS14all
GeoVisionGV_VS03all
GeoVisionGV_VS2410all
GeoVisionGV_VS28XXall
GeoVisionGV_VS216XXall
GeoVisionGV VS04Aall
GeoVisionGV VS04Hall
GeoVisionGVLX 4 V2all
GeoVisionGVLX 4 V3all
GeoVisionGV_IPCAMD_GV_BX130all
GeoVisionGV_GM8186_VS14all
geovisiongv-dsp_lpr_v2< *
geovisiongv-bx1500< *
geovisiongv-cb220< *
geovisiongv-ebl1100< *
geovisiongv-efd1100< *
geovisiongv-fd2410< *
geovisiongv-fd3400< *
geovisiongv-fd3401< *
geovisiongv-fe420< *
geovisiongv-vs14< *
geovisiongv-vs03< *
geovisiongv-vs2410< *
geovisiongv-vs04a< *
geovisiongv-vs04h< *
geovisiongv-lx_4_v2< *
geovisiongv-lx_4_v3< *
geovisiongv-vs28xx< *
geovisiongv-vs216xx< *

References

Timeline

Published
Jun 17, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
May 7, 2025
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-60489.8Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker cCVE-2024-60497.5The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a speciCVE-2024-60506.1Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site ScripCVE-2024-60514.3Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate thCVE-2024-60525.4Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTCVE-2024-60534.3Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior CVE-2024-60548.8The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_postCVE-2024-60554.7Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on WinCVE-2024-60565.3A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknowCVE-2024-60579.8Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that CVE-2024-60586.1A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?coCVE-2024-60594.8A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown proces
CVE-2024-6047: Critical severity, CVSS 9.8 | Vulnix