CVE-2019-20085

TVT NVMS-1000 devices have a directory traversal vulnerability that allows attackers to access files outside the intended directory by using special path sequences in web requests. This lets unauthorized users view sensitive system files and configuration data.

The NVMS-1000 web interface fails to properly validate GET request paths, allowing directory traversal via path traversal sequences (../) to escape the intended root directory (CWE-22). An unauthenticated remote attacker can exploit this to read arbitrary files with application privileges, potentially exposing credentials and system configuration.