CVE‑2019‑20085: TVT NVMS‑1000 Directory Traversal Vulnerability
What It Is – The TVT NVMS‑1000 video‑management software allows an attacker to request arbitrary files on the underlying system by sending a crafted GET /.. request. This is a classic directory‑traversal flaw that bypasses normal file‑system access controls.
Exploitability – Public proof‑of‑concept code exists; the vulnerability is rated High (CVSS v3.1 ≈ 7.5). No authentication is required to trigger the issue.
Affected Products – TVT NVMS‑1000 (all versions prior to the vendor’s September 2020 patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration and input‑validation controls that can be continuously monitored and evidenced for audit purposes.
- Highlights how a single mis‑configured service can break the “defensible evidence” chain required by enterprise buyers during security due‑diligence.
- Reinforces the importance of control‑mapping: linking the technical fix to the underlying control objective (file‑system access restrictions) across frameworks such as NIST CSF 2.0.
Recommended Actions
- Apply TVT’s security patch released September 2020 or later.
- Verify that the web interface rejects any
../path sequences; test with a controlled request. - Update your control‑mapping inventory to reflect the remediation and capture evidence (patch version, scan results) for audit readiness.
- Incorporate the fix into your continuous monitoring pipeline to detect any re‑introduction of the flaw.
Source: CISA KEV – CVE‑2019‑20085