CVE-2013-6023
high · 7.8Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbitrary files via .. (dot dot) in the URI.
7.8
CVSS
10.2%
EPSS (exploit prob.)
95th
EPSS percentile
2013-11-02
Published
AV:N/AC:L/Au:N/C:C/I:N/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| tvt | dvr | td-2308ss-b |
| tvt | dvr_firmware | <= 3.2.0.p-3520a-03 |
| tvt | dvr_firmware | 3.1.6.p-1.0.2.1-03 |
| tvt | dvr_firmware | 3.1.7.b-1.0.2.1-00 |
| tvt | dvr_firmware | 3.1.43.b |
| tvt | dvr_firmware | 3.1.43.p |
| tvt | dvr_firmware | 3.1.75.b-1.0.2.1-00 |
| tvt | dvr_firmware | 3.1.81.b-1.0.2.1-00 |
| tvt | dvr_firmware | 3.1.83.b-1.0.2.1-00 |
| tvt | dvr_firmware | 3.1.83.p-1.0.4.2-03 |
| tvt | dvr_firmware | 3.1.87.p-1.0.4.2-17 |
| tvt | dvr_firmware | 3.1.91.p-1.0.2.1-03 |
| tvt | dvr_firmware | 3.1.92.p-1.0.2.1-00 |
| tvt | dvr_firmware | 3.1.93.b-1.0.2.1-17 |
| tvt | dvr_firmware | 3.2.0.b-1.0.2.1-17 |
| tvt | dvr_firmware | 3.2.0.p-1.0.2.1-03 |
| tvt | dvr_firmware | 3.2.0.p-1.0.2.1-17 |
| tvt | dvr_firmware | 3.2.0.p-1.0.6.0.32-00 |
Check a specific version with /api/v1/cve/match.
References
- http://alguienenlafisi.blogspot.com/2013/10/dvr-tvt-directory-traversal.html
- http://www.exploit-db.com/exploits/29959
- http://www.kb.cert.org/vuls/id/785838
- http://www.securityfocus.com/bid/63360
- http://alguienenlafisi.blogspot.com/2013/10/dvr-tvt-directory-traversal.html
- http://www.exploit-db.com/exploits/29959
- http://www.kb.cert.org/vuls/id/785838
- http://www.securityfocus.com/bid/63360
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2013-6023