iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. Akamai’s Security Intelligence and Response Team (SIRT) reported that attackers exploited command-injection flaws in retired GeoVision devices to run commands without authentication and install Mirai-based malware. Its honeypots first recorded the activity in April 2025. The report does not establish that every GeoVision camera or recorder is affected, or that attacks are still active today.
What happened in the attacks?
Attackers sent requests to /DateSetting.cgi and injected shell commands through the szSrvIpAddr parameter. The flaw let them execute commands remotely without logging in. Akamai decoded a payload that downloaded and ran an ARM malware file named boatnet, which it identified as an LZRD Mirai variant. The observed malware had functions consistent with Mirai botnets, and Akamai also saw the botnet probe for other IoT vulnerabilities.
Akamai published its account on May 6, 2025, under security researcher Kyle Lefton’s name. The activity was first seen in April 2025; that observation is evidence of exploitation at that time, not confirmation of an ongoing campaign in October 2026.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhich GeoVision products are listed?
The Belgian Centre for Cybersecurity (CCB) lists end-of-life products in these families. The list identifies retired product lines and examples; it should not be read as proof that every listed model was individually observed in this campaign.
#1 Best Overall
- [Overview]: GV-EBD4704 is an outdoor, network camera equipped with an automatic IR-cut filter and an IR LED for day and night surveillance. The camera adheres to IP67 standards. The camera supports H.265 video codec to achieve better compression ratio while maintaining high quality pictures at reduced network bandwidths.
- [Specs]: Sensor:1/3" progressive scan low lux CMOS sensor- Resolution: Up to 30 fps at 2688 x 1520, Lens: 2.8mm lens - Camera Angle Adjustment: Pan 0° ~ 360° Tilt 0° ~ 75°, Built-in microphone, IR distance up to 30 m (100 ft) - 1 IR LED, Day and Night function (with removable IR-cut filter).
- [Weatherproof]: This camera features heavy-duty metal weatherproof IP67 housing & IK10 Vandal Resistant.
- [Smart Security]: Wide Dynamic Range Pro (WDR Pro) - Defog - 3D noise reduction - Motion detection. The camera supported by smart motion detection technology, senses humans & vehicles, receive intelligent alerts via the Geovision app anytime motion is detected.
- [Easy Installation]: This PoE camera uses a single Ethernet cable to transmit both data and power. Simplified wiring means easier and clean installation.
- DSP LPR: GV_DSP_LPR_V2.
- IP cameras: GV_IPCAMD_GV_BX1500, GV_IPCAMD_GV_CB220, GV_IPCAMD_GV_EBL1100, GV_IPCAMD_GV_EFD1100, GV_IPCAMD_GV_FD2410, GV_IPCAMD_GV_FD3400, GV_IPCAMD_GV_FE3401, and GV_IPCAMD_GV_FE420.
- Video servers: GV-VS14_VS14, GV_VS03, GV_VS2410, GV_VS28XX, GV_VS216XX, GV VS04A, and GV VS04H.
- DVRs: GVLX 4 V2 and GVLX 4 V3.
Check the model identifier on the device label or in its management interface, then compare it with the CCB end-of-life list. A GeoVision brand name alone is not enough to determine exposure: the cited reports concern retired devices, not every model the company has made.
What are CVE-2024-6047 and CVE-2024-11120?
They are the identifiers of the two command-injection vulnerabilities Akamai associated with the attacks. Akamai says CVE-2024-6047 was initially reported in June 2024 and CVE-2024-11120 in November 2024. The CCB assigns CVE-2024-6047 a CVSS score of 9.8, classified as critical. That score is specific to CVE-2024-6047; the cited Akamai and CCB reports do not give a score for CVE-2024-11120.
Rank #2
- 1/2.7" progressive scan super low lux CMOS
- Day and Night function (with removable IR-cut filter)
- Built-in micro SD card slot (SD / SDHC / SDXC / UHS-I, Class 10) for local storage
- AI deep learning: AI Perimeter Protection & Classification (Human, Vehicle)
- IP67. Two-way audio. Alarm sound and warm LED light triggered on AI detection events
The title’s “zero-day” wording can be misleading here: the vulnerabilities had been reported in 2024, before Akamai’s honeypots saw exploitation in April 2025. The available information therefore supports describing this as exploitation of known vulnerabilities in discontinued products, not claiming that the attacks began as previously unknown flaws.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Should you replace the device or isolate it?
Replacement with a supported product is the preferred response. Akamai said GeoVision confirmed the affected models were retired and would receive no further updates. GeoVision’s policy says its latest security patches and updates are available in software or firmware releases for products that remain supported; check its product download page for the status and available releases for a specific device.
Rank #3
- [Overview]: This Bullet IP Camera is an outdoor, network camera equipped with an automatic IR-cut filter, one IR LED and two warm LEDs for day and night surveillance. The camera supports H.265 video codec to achieve better compression ratio while maintaining high quality pictures at reduced network bandwidths.
- [Specs]: Sensor: 1/2.7" progressive scan low lux CMOS sensor- Resolution: Up to 20 fps at 3840 x 2160, Lens: 2.8mm lens - Camera Angle Adjustment: Pan 0° ~ 360° Tilt 0° ~ 75°, IR distance up to 30 m (100 ft) - 1 IR LED, Day and Night function (with removable IR-cut filter), 3-axis mechanism (pan / tilt / rotate), built-in micro SD card slot (SD/SDHC/SDXC/UHS-I, Class 10) for local storage.
- [Weatherproof]: This camera features heavy-duty metal weatherproof IP67 housing & IK10 Vandal Resistant.
- [Smart Security]: Empowered by deep learning algorithms, AI technology distinguishes human and vehicles from other moving objects. Integrated with GeoVision Video Management Software (VMS), it supports AI perimeter protection, real time alert, events playback and more.
- [Easy Installation]: This PoE camera uses a single Ethernet cable to transmit both data and power. Simplified wiring means easier and clean installation.
| Response | Support status | Exposure | When it fits | Patch position |
|---|---|---|---|---|
| Replace with a supported product | Supported product, subject to the model’s status | Can be configured to avoid direct internet exposure | Preferred when replacement is feasible | Check GeoVision’s download page for the chosen product’s available releases |
| Keep temporarily, isolated | End-of-life device remains unsupported | Separate VLAN, with no internet access | Transition period when immediate replacement is not feasible | Akamai reported no further updates for the affected retired models |
| Leave internet-facing | End-of-life device remains unsupported | Exposed to internet-originated attacks | Not recommended | No further updates for the affected retired models, according to Akamai |
Isolation reduces exposure but does not fix the vulnerability or make an end-of-life device supported. If the device must stay in service during a transition, treat isolation as a temporary risk-reduction measure rather than a permanent remedy.
How to reduce risk while a legacy device remains installed
- Confirm the model and lifecycle status. Record the exact model number and check whether it appears in the CCB’s end-of-life product information. Do not assume that a device is safe merely because it is not among the examples listed above.
- Remove direct internet access. Put cameras, access-control equipment, and security-management systems on a separate VLAN without internet access, as the CCB recommends. Review firewall and routing rules so the segment cannot reach the internet through another path.
- Limit access from the rest of the network. Allow only the specific local systems that need to communicate with the device. Avoid exposing its management interface to the public internet.
- Monitor logs and network activity. The CCB recommends monitoring logs for suspicious activity. Investigate unexpected outbound connections, unexplained device activity, and requests involving
/DateSetting.cgior theszSrvIpAddrparameter; those indicators are relevant to this reported attack but are not a complete detection method. - Plan the replacement. Move to a supported product and confirm its lifecycle status and available firmware or software updates through GeoVision’s product download page.
What GeoVision says about security updates
GeoVision says its latest security patches and updates are included in the latest software or firmware releases and are available from its product download page “provided the product is still supported by GeoVision.” The policy describes a four-stage process: Discover, Analyze, Prioritize, and Solution update & follow up. Its stated targets are a first response within 48 hours, a severity and impact assessment within 72 hours, and a final report within one month. These are policy targets; they do not mean that a patch is available for a retired product.
Quick Recap
Best Value
- [Overview]: GV-FER 5702 is a 5 MP outdoor fisheye camera allowing you to monitor all angles of a location and can be installed to the ceiling or the wall. The camera supports H.265 video codec to achieve better compression ratio while maintaining high quality image at reduced network bandwidths.
- [Specs]: Sensor: 1/2.8" progressive scan CMOS sensor - Resolution: Up to 30 fps at 2592 × 1944, Lens: 2.8mm lens - Built-in microphone, IR distance up to 20 m (65 ft) - 1 IR LED, Day and Night function (with removable IR-cut filter).
- [Weatherproof]: This camera features heavy-duty metal weatherproof IP67 housing & IK10 Vandal Resistant.
- [Smart Security]: Wide Dynamic Range Pro (WDR Pro) - Defog - 3D noise reduction - Motion detection. The camera supported by smart motion detection technology, senses humans & vehicles, receive intelligent alerts via the Geovision app anytime motion is detected.
- [Easy Installation]: This PoE camera uses a single Ethernet cable to transmit both data and power. Simplified wiring means easier and clean installation.
Rank #4
- USA Vision IP Camera 8MP Fixed Lens 2.8mm.
- AI analytics: Pedestrian & Vehicle Detection.
- Triple streams from H.265, H.264. Full Color smart warm LED.
- IR distance up to 30 m (100 ft).
- Built-in microphone. Built-in micro SD card slot, up to 256 GB.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
