CVE-2019-20085

What Is TVT NVMS-1000?

NVMS-1000 is network video management server/DVR software developed by the Chinese manufacturer TVT Digital Technology and white-labeled under dozens of different brand names for budget CCTV DVRs and NVRs sold worldwide. This "one firmware, many brands" model means a single vulnerability in NVMS-1000 can affect a huge population of internet-connected security cameras regardless of the sticker on the box, and it makes patch coordination across resellers extremely difficult.

Overview

CVE-2019-20085 is a directory traversal vulnerability (CWE-22) in TVT NVMS-1000-based devices, reachable by an unauthenticated remote attacker via crafted GET /../ style HTTP requests. With a CVSS score of 7.5, it primarily impacts confidentiality — allowing arbitrary file disclosure from the device's filesystem, which commonly includes configuration files containing plaintext or weakly protected administrator credentials.

Technical Details

The vulnerability arises because the device's embedded web server fails to normalize or reject path traversal sequences (../) in requested URLs before mapping them to the filesystem. A request such as GET /../../../../etc/passwd (or equivalent Windows-style traversal on devices with different underlying OS layouts) can retrieve files outside the intended web root. On NVMS-1000-based DVRs, this is frequently used to pull configuration files that expose the admin password, which an attacker then uses to fully log into the device's video management interface.

No authentication or user interaction is required, and the flaw can be triggered with a single crafted HTTP GET request, making it trivially scriptable for internet-wide scanning.

Discovery

This flaw follows a well-documented pattern of directory traversal bugs found across white-labeled Chinese DVR/NVR firmware; it was addressed through the vendor's standard disclosure handling rather than a named independent researcher credit that can be confidently attributed here.

Exploitation Context

TVT NVMS-1000-based DVRs have long been popular targets for IoT botnets — directory traversal bugs that leak admin credentials are a favored technique because they bypass the need to brute-force or guess passwords entirely. CISA's KEV listing confirms this specific CVE has been observed exploited in the wild, consistent with ongoing internet-wide scanning campaigns against exposed CCTV/DVR infrastructure that feed botnets such as those in the Mirai lineage.

Remediation

1. Update device firmware to a version from the manufacturer (or reseller) that fixes CVE-2019-20085, if available.
2. Never expose DVR/NVR web management interfaces directly to the internet — place them behind a VPN or firewall with strict access control.
3. Change default administrator credentials immediately upon deployment, independent of whether traversal is patched.
4. Segment IoT/CCTV devices on a separate VLAN isolated from sensitive internal networks.
5. Replace unsupported hardware — many white-labeled NVMS-1000 devices no longer receive vendor updates and should be retired if patches are unavailable.