CVE-2019-20085

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Basic Information

CVE State: PUBLISHED
Reserved Date: December 30, 2019
Published Date: December 30, 2019
Last Updated: July 30, 2025
Vendor: TVT
Product: NVMS-1000
Description: TVT NVMS-1000 devices allow GET /.. Directory Traversal
Tags

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (2021-11-03 00:00:00 UTC) Source

References

https://www.exploit-db.com/exploits/47774 http://packetstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2021-11-03 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20085.yaml	2025-04-26 00:00:00 UTC

Timeline

CVE ID Reserved

December 30, 2019
CVE Published to Public

December 30, 2019
Added to KEVIntel

November 03, 2021
Detected by Nuclei

April 26, 2025