{"cveID":"CVE-2024-11120","vendorProject":"GeoVision","product":"Multiple Devices","vulnerabilityName":"GeoVision Devices OS Command Injection Vulnerability","dateAdded":"2025-05-07","shortDescription":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-05-28","knownRansomwareCampaignUse":"Unknown","notes":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-11120","cwes":["CWE-78"],"year":2024,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2024-11120","technique":"T1133","technique_name_at_mapping":"External Remote Services","mapping_type":"exploitation_technique","capability_group":"command_injection","comments":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system.","references":["https://www.armis.com/threat-alert/eol-geovision-devices-os-command-injection-vulnerability/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2024-11120","technique":"T1203","technique_name_at_mapping":"Exploitation for Client Execution","mapping_type":"exploitation_technique","capability_group":"command_injection","comments":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system.","references":["https://www.armis.com/threat-alert/eol-geovision-devices-os-command-injection-vulnerability/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2024-11120","technique":"T1498","technique_name_at_mapping":"Network Denial of Service","mapping_type":"primary_impact","capability_group":"command_injection","comments":"Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system. This leads to denial of service.","references":["https://www.armis.com/threat-alert/eol-geovision-devices-os-command-injection-vulnerability/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1133","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"External Remote Services","name_at_mapping":"External Remote Services","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":20,"has_detection_strategy":true},{"id":"T1203","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Exploitation for Client Execution","name_at_mapping":"Exploitation for Client Execution","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":35,"has_detection_strategy":true},{"id":"T1498","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Network Denial of Service","name_at_mapping":"Network Denial of Service","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":3,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}