CVE-2024-6047

This vulnerability lets someone on the network send a special message that the device wrongly treats as a command. Because it doesn’t require a login, a person who can reach the device can make it run arbitrary commands. In plain terms: the device can be remotely “controlled” in ways its owner didn’t intend—like an attacker getting a remote admin console.

This matters if you run or still have GeoVision EOL devices on your network using one of these firmware families: gv-dsp lpr, gv-bx130, gv-bx1500, gv-cb220, gv-ebl1100, gv-efd1100, gv-fd2410, gv-fd3400, gv-fe3401, or gv-fe420.
The key risk gate is reachability over the network: because it can be exploited without authentication, any attacker who can reach the device (for example via internet exposure or untrusted network access) is in scope.
If your devices are not reachable from untrusted networks, the risk is reduced, but the devices still represent a high-risk asset because they are EOL and vendor support is unavailable.

This is RED because CISA has added CVE-2024-6047 to its Known Exploited Vulnerabilities list, meaning it’s treated as actively real and actionable.
The weakness can be triggered remotely with no authentication, so exposure over the network can let attackers run commands on the device, leading to takeover and disruption.