CVE-2019-20085
CVE-2019-20085
In short
TVT NVMS-1000 devices have a directory traversal vulnerability that allows attackers to access files outside the intended directory by using special path sequences in web requests. This lets unauthorized users view sensitive system files and configuration data.
Technical detail
The NVMS-1000 web interface fails to properly validate GET request paths, allowing directory traversal via path traversal sequences (../) to escape the intended root directory (CWE-22). An unauthenticated remote attacker can exploit this to read arbitrary files with application privileges, potentially exposing credentials and system configuration.
Summary generated and translated by AI from the official description.
TVT NVMS-1000 devices allow GET /.. Directory Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/apublic PoCs found — 6
githubgithub.com/AleDiBen/NVMS1000-Exploit★ 6githubgithub.com/0hmsec/NVMS-1000-Directory-Traversal-Bash★ 0githubgithub.com/Z3R0space/CVE-2019-20085★ 0cve_referencepacketstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.htmlunverifiedcve_referencewww.exploit-db.com/exploits/47774unverifiedexploitdbwww.exploit-db.com/exploits/48311unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →