CVE-2024-6047

GeoVision devices have a critical, actively exploited OS command injection vulnerability allowing remote code execution without authentication, potentially impacting DIB organizations using these devices for surveillance or security purposes.

Multiple GeoVision devices are vulnerable to OS command injection, enabling unauthenticated attackers to execute arbitrary commands remotely. This poses a significant risk of data compromise and system takeover, especially given the potential for these devices to be end-of-life or end-of-service. DIB organizations should immediately assess their use of GeoVision devices and discontinue utilization if present.

Shame score — The vulnerability's ease of exploitation, lack of authentication requirement, and active exploitation in the wild demonstrate a serious failure in secure coding practices and device hardening.