CVE-2019-20085
TVT NVMS-1000 Directory Traversal Vulnerability
Description
CVE-2019-20085 is a high-severity directory traversal vulnerability affecting TVT NVMS-1000 network video management devices. The vulnerability allows unauthenticated remote attackers to traverse the file system using crafted GET /.. requests, enabling them to read arbitrary files on the affected device. CISA has confirmed active exploitation of this vulnerability by including it in the Known Exploited Vulnerabilities (KEV) catalog. With an exceptionally high EPSS score of 94.19% (99.9th percentile), this vulnerability is among the most likely to be exploited in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tvt | nvms-1000 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/47774(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20085(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Path Traversal occurs when software uses external input to construct a pathname that should be restricted to a limited directory, but fails to properly neutralize special elements such as ".." sequences that can resolve to a location outside of that directory. In the context of CVE-2019-20085, the TVT NVMS-1000 web interface fails to sanitize directory traversal sequences in GET requests, allowing attackers to escape the intended web root and access arbitrary files on the underlying file system.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2019-20085 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting a significant information disclosure risk. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any remote attacker. Confidentiality (High): successful exploitation allows reading of arbitrary files from the device, which may include configuration files, credentials, recorded video data, or other sensitive information. Integrity (None) and Availability (None): the vulnerability does not directly allow data modification or service disruption, though disclosed credentials could enable further attacks. The EPSS score of 94.19% (99.9th percentile) places this vulnerability among the most actively targeted, indicating near-certain exploitation activity across the internet.
Exploit Maturity
Public exploit code is available for CVE-2019-20085 via Exploit Database and Packet Storm Security, significantly lowering the barrier to exploitation. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 94.19% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most frequently targeted vulnerabilities in the wild. The trivial nature of the exploit (simple GET requests with dot-dot-slash sequences) combined with publicly available exploit code makes this vulnerability accessible to even low-skilled attackers.
Remediation
- Apply vendor firmware updates immediately as required by the CISA KEV directive: Apply updates per vendor instructions. Check TVT's support channels for the latest NVMS-1000 firmware that addresses the directory traversal vulnerability.
- If firmware updates are unavailable or cannot be applied immediately, isolate affected TVT NVMS-1000 devices from the internet by placing them behind a firewall or VPN, ensuring they are not directly accessible from untrusted networks.
- Implement web application firewall (WAF) rules or reverse proxy configurations that block requests containing directory traversal sequences ("../", "..%2f", "%2e%2e/") targeting the NVMS-1000 web interface.
- Monitor network traffic to and from NVMS-1000 devices for signs of directory traversal exploitation, including GET requests with ".." patterns, and review access logs for evidence of unauthorized file access.
- Audit exposed credentials and configuration data that may have been compromised through this vulnerability, rotating passwords and API keys for any services whose credentials were stored on the affected device.
Technical Details
CVE-2019-20085 exploits a path traversal weakness (CWE-22) in the TVT NVMS-1000 firmware web server. The device's HTTP server fails to properly sanitize directory traversal sequences in incoming GET requests, allowing an attacker to send requests like "GET /.." followed by additional path components to navigate outside the intended web root directory and read arbitrary files from the file system. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based, trivially simple to execute, requires no authentication or user interaction, and results in high confidentiality impact while not affecting integrity or availability. The vulnerability is particularly dangerous in network video surveillance environments where NVMS-1000 devices may store recorded footage, camera credentials, and network configuration data that could be leveraged for further attacks.
Frequently Asked Questions
Is CVE-2019-20085 being actively exploited?
Yes. CVE-2019-20085 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.19% (99.9th percentile) indicates near-certain exploitation activity. Public exploit code is readily available, making this vulnerability accessible to a wide range of attackers. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2019-20085?
CVE-2019-20085 affects TVT NVMS-1000 firmware across all known versions. These are network video management system devices used for surveillance camera management and video recording.
How do I fix CVE-2019-20085?
Apply the latest firmware update from TVT that addresses the directory traversal vulnerability. If firmware updates are not available, immediately isolate affected NVMS-1000 devices from the internet and restrict access to trusted networks only via firewall rules or VPN.
How severe is CVE-2019-20085?
CVE-2019-20085 has a CVSS 3.1 score of 7.5 (HIGH). The vulnerability allows unauthenticated remote attackers to read arbitrary files from affected devices with minimal effort. The EPSS score of 94.19% places it in the 99.9th percentile for exploitation probability, indicating it is among the most frequently targeted vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.