// For flags

CVE-2019-20085

TVT NVMS-1000 Directory Traversal Vulnerability

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

4
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Los dispositivos TVT NVMS-1000, permiten un Salto de Directorio de GET /..

TVT NVMS 1000 suffers from a directory traversal vulnerability.

TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-30 CVE Reserved
  • 2019-12-30 CVE Published
  • 2020-04-13 First Exploit
  • 2021-11-03 Exploited in Wild
  • 2022-05-03 KEV Due Date
  • 2024-08-05 CVE Updated
  • 2025-01-10 EPSS Updated
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tvt
Search vendor "Tvt"
 Nvms-1000 Firmware
Search vendor "Tvt" for product "Nvms-1000 Firmware"
--
Affected
in Tvt
Search vendor "Tvt"
 Nvms-1000
Search vendor "Tvt" for product "Nvms-1000"
--
Safe