Description
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GeoVision | GV_DSP_LPR_V2 | all | — |
| GeoVision | GV_IPCAMD_GV_BX1500 | all | — |
| GeoVision | GV_IPCAMD_GV_CB220 | all | — |
| GeoVision | GV_IPCAMD_GV_EBL1100 | all | — |
| GeoVision | GV_IPCAMD_GV_EFD1100 | all | — |
| GeoVision | GV_IPCAMD_GV_FD2410 | all | — |
| GeoVision | GV_IPCAMD_GV_FD3400 | all | — |
| GeoVision | GV_IPCAMD_GV_FE3401 | all | — |
| GeoVision | GV_IPCAMD_GV_FE420 | all | — |
| GeoVision | GV-VS14_VS14 | all | — |
| GeoVision | GV_VS03 | all | — |
| GeoVision | GV_VS2410 | all | — |
| GeoVision | GV_VS28XX | all | — |
| GeoVision | GV_VS216XX | all | — |
| GeoVision | GV VS04A | all | — |
| GeoVision | GV VS04H | all | — |
| GeoVision | GVLX 4 V2 | all | — |
| GeoVision | GVLX 4 V3 | all | — |
| GeoVision | GV_IPCAMD_GV_BX130 | all | — |
| GeoVision | GV_GM8186_VS14 | all | — |
References
- https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html third-party-advisory