CVE-2024-11120

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 2 articles

VulnLookup ↗ NVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

66.14%

probability

This CVE has a 66.14% probability of being exploited in the next 30 days.

0% Top 98.5th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-707 · Improper Neutralization CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77 · Command Injection CWE-78 · OS Command Injection

Botnet exploits GeoVision zero-day to install Mirai malware

BleepingComputer Nov 15, 2024

Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet

TheHackerNews

Signal Intelligence

Confidenceⓘ

85%

EPSS 66.14%

Mentions 2

Last Seen Nov 15, 2024

CNA Information

Analyst Note

CVE-2024-11120 is explicitly described by the vendor as 'already exploited by attackers' with related reports received. The BleepingComputer article explicitly names this as a 'GeoVision zero-day' being actively exploited by botnets to install Mirai malware. Publication date (2024-11-15) aligns with active exploitation reports, indicating zero-day status at time of discovery.

Triage Info

Decided atMar 05, 2026