Description
GeoVision 是一家提供视频监控解决方案的公司，其产品包括视频服务器和 IP 摄像机等。该漏洞存在于 GeoVision 的 /DateSetting.cgi 接口中，攻击者可以通过发送特制的请求数据，利用命令注入漏洞执行任意命令，可能导致设备被完全控制。
GeoVision /DateSetting.cgi 命令执行漏洞（CVE-2024-11120）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-11120
https://www.cve.org/CVERecord?id=CVE-2024-11120
https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf
https://www.armis.com/threat-alert/eol-geovision-devices-os-command-injection-vulnerability/
https://thehackernews.com/2025/05/hackers-exploit-samsung-magicinfo.html
https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html
https://github.com/advisories/GHSA-hq2j-jpv4-q865
https://securityonline.info/botnet-exploits-old-geovision-iot-devices-via-cve-2024-6047-cve-2024-11120/
https://www.anquanke.com/post/id/307139