ByteOS Network

Vulnerability Details :

CVE-2020-11949

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-28 May, 2020 | 12:43

Updated At-04 Aug, 2024 | 11:42

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:28 May, 2020 | 12:43

Updated At:04 Aug, 2024 | 11:42

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf	x_refsource_CONFIRM

Hyperlink: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf	x_refsource_CONFIRM x_transferred

Hyperlink: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:28 May, 2020 | 13:15

Updated At:21 Jul, 2021 | 11:39

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

vivotek>>cc9381-hv_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:cc9381-hv_firmware:*:*:*:*:*:*:*:*

vivotek>>cc9381-hv>>-

cpe:2.3:h:vivotek:cc9381-hv:-:*:*:*:*:*:*:*

vivotek>>fd9360-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9360-h_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9360-h>>-

cpe:2.3:h:vivotek:fd9360-h:-:*:*:*:*:*:*:*

vivotek>>fd9368-htv_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9368-htv_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9368-htv>>-

cpe:2.3:h:vivotek:fd9368-htv:-:*:*:*:*:*:*:*

vivotek>>fd9380-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9380-h_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9380-h>>-

cpe:2.3:h:vivotek:fd9380-h:-:*:*:*:*:*:*:*

vivotek>>fd9388-htv_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9388-htv_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9388-htv>>-

cpe:2.3:h:vivotek:fd9388-htv:-:*:*:*:*:*:*:*

vivotek>>ib9360-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:ib9360-h_firmware:*:*:*:*:*:*:*:*

vivotek>>ib9360-h>>-

cpe:2.3:h:vivotek:ib9360-h:-:*:*:*:*:*:*:*

vivotek>>ib9368-ht_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:ib9368-ht_firmware:*:*:*:*:*:*:*:*

vivotek>>ib9368-ht>>-

cpe:2.3:h:vivotek:ib9368-ht:-:*:*:*:*:*:*:*

vivotek>>ib9380-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:ib9380-h_firmware:*:*:*:*:*:*:*:*

vivotek>>ib9380-h>>-

cpe:2.3:h:vivotek:ib9380-h:-:*:*:*:*:*:*:*

vivotek>>ib9388-ht_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:ib9388-ht_firmware:*:*:*:*:*:*:*:*

vivotek>>ib9388-ht>>-

cpe:2.3:h:vivotek:ib9388-ht:-:*:*:*:*:*:*:*

vivotek>>it9360-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:it9360-h_firmware:*:*:*:*:*:*:*:*

vivotek>>it9360-h>>-

cpe:2.3:h:vivotek:it9360-h:-:*:*:*:*:*:*:*

vivotek>>it9380-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:it9380-h_firmware:*:*:*:*:*:*:*:*

vivotek>>it9380-h>>-

cpe:2.3:h:vivotek:it9380-h:-:*:*:*:*:*:*:*

vivotek>>it9388-ht_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:it9388-ht_firmware:*:*:*:*:*:*:*:*

vivotek>>it9388-ht>>-

cpe:2.3:h:vivotek:it9388-ht:-:*:*:*:*:*:*:*

vivotek>>md9560-dh_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:md9560-dh_firmware:*:*:*:*:*:*:*:*

vivotek>>md9560-dh>>-

cpe:2.3:h:vivotek:md9560-dh:-:*:*:*:*:*:*:*

vivotek>>md9560-h_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:md9560-h_firmware:*:*:*:*:*:*:*:*

vivotek>>md9560-h>>-

cpe:2.3:h:vivotek:md9560-h:-:*:*:*:*:*:*:*

vivotek>>fd9366-hv_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9366-hv_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9366-hv>>-

cpe:2.3:h:vivotek:fd9366-hv:-:*:*:*:*:*:*:*

vivotek>>fd9166-hn_firmware>>Versions up to 0222g(inclusive)

cpe:2.3:o:vivotek:fd9166-hn_firmware:*:*:*:*:*:*:*:*

vivotek>>fd9166-hn>>-

cpe:2.3:h:vivotek:fd9166-hn:-:*:*:*:*:*:*:*

vivotek>>fe9380-hv_firmware>>Versions up to 0222k(inclusive)

cpe:2.3:o:vivotek:fe9380-hv_firmware:*:*:*:*:*:*:*:*

vivotek>>fe9380-hv>>-

cpe:2.3:h:vivotek:fe9380-hv:-:*:*:*:*:*:*:*

vivotek>>cc8160_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:cc8160_firmware:*:*:*:*:*:*:*:*

vivotek>>cc8160>>-

cpe:2.3:h:vivotek:cc8160:-:*:*:*:*:*:*:*

vivotek>>cc8160\(hs\)_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:cc8160\(hs\)_firmware:*:*:*:*:*:*:*:*

vivotek>>cc8160\(hs\)>>-

cpe:2.3:h:vivotek:cc8160\(hs\):-:*:*:*:*:*:*:*

vivotek>>cc8370-hv_firmware>>Versions up to 0213b(inclusive)

cpe:2.3:o:vivotek:cc8370-hv_firmware:*:*:*:*:*:*:*:*

vivotek>>cc8370-hv>>-

cpe:2.3:h:vivotek:cc8370-hv:-:*:*:*:*:*:*:*

vivotek>>cc8371-hv_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:cc8371-hv_firmware:*:*:*:*:*:*:*:*

vivotek>>cc8371-hv>>-

cpe:2.3:h:vivotek:cc8371-hv:-:*:*:*:*:*:*:*

vivotek>>cd8371-hntv_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:cd8371-hntv_firmware:*:*:*:*:*:*:*:*

vivotek>>cd8371-hntv>>-

cpe:2.3:h:vivotek:cd8371-hntv:-:*:*:*:*:*:*:*

vivotek>>cd8371-hnvf2_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:cd8371-hnvf2_firmware:*:*:*:*:*:*:*:*

vivotek>>cd8371-hnvf2>>-

cpe:2.3:h:vivotek:cd8371-hnvf2:-:*:*:*:*:*:*:*

vivotek>>fd8166a_firmware>>Versions up to 0213b(inclusive)

cpe:2.3:o:vivotek:fd8166a_firmware:*:*:*:*:*:*:*:*

vivotek>>fd8166a>>-

cpe:2.3:h:vivotek:fd8166a:-:*:*:*:*:*:*:*

vivotek>>fd8166a-n_firmware>>Versions up to 0113b(inclusive)

cpe:2.3:o:vivotek:fd8166a-n_firmware:*:*:*:*:*:*:*:*

vivotek>>fd8166a-n>>-

cpe:2.3:h:vivotek:fd8166a-n:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf	cve@mitre.org	Vendor Advisory

Hyperlink: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf

Source: cve@mitre.org

Resource:

Vendor Advisory

Similar CVEs

3Records found

CVE-2013-1597

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-14.19% / 96.14%

7 Day CHG~0.00%

Published-24 Jan, 2020 | 18:08

Updated-06 Aug, 2024 | 15:04

A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user obtain user credentials.

Vendor-vivotek n/a

Product-pt7135_firmware pt7135 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2026-35718

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.74% / 50.14%

7 Day CHG~0.00%

Published-02 Jun, 2026 | 00:00

Updated-03 Jun, 2026 | 19:16

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request.

Vendor-vivotek n/a

Product-fd8136_firmware fd8136 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2025-66051

Matching Score-8

Assigner-CERT.PL

View Details

Matching Score-8

Assigner-CERT.PL

CVSS Score-6.9||MEDIUM

EPSS-0.71% / 49.02%

7 Day CHG~0.00%

Published-09 Jan, 2026 | 11:54

Updated-14 Jan, 2026 | 17:49

Path traversal in Vivotek IP7137 cameras

Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. Due to CVE-2025-66050, a password for administration panel is not set by default. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

Vendor-vivotek Vivotek

Product-ip7137_firmware ip7137 IP7137

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-11949

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs