{"cve":"CVE-2020-11949","nvd":{"published":"2020-05-28T13:15:11.317","modified":"2026-06-17T02:51:06.897","status":"Modified","description":"testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":[],"references":["http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf","http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf"],"products":["vivotek:cc8160\\(hs\\)_firmware","vivotek:cc8160_firmware","vivotek:cc8370-hv_firmware","vivotek:cc8371-hv_firmware","vivotek:cc9381-hv_firmware","vivotek:cd8371-hntv_firmware","vivotek:cd8371-hnvf2_firmware","vivotek:fd8166a-n_firmware","vivotek:fd8166a_firmware","vivotek:fd8167a_firmware","vivotek:fd8169a_firmware","vivotek:fd816b-hf2_firmware","vivotek:fd816b-ht_firmware","vivotek:fd816ba-hf2_firmware","vivotek:fd816ba-ht_firmware","vivotek:fd816c-hf2_firmware","vivotek:fd816ca-hf2_firmware","vivotek:fd8177-h_firmware","vivotek:fd8177-ht_firmware","vivotek:fd8179-h_firmware","vivotek:fd8182-f1_firmware","vivotek:fd8182-f2_firmware","vivotek:fd8182-t_firmware","vivotek:fd8366-v_firmware","vivotek:fd8367a-v_firmware","vivotek:fd8369a-v_firmware","vivotek:fd836b-ehtv_firmware","vivotek:fd836b-ehvf2_firmware","vivotek:fd836b-htv_firmware","vivotek:fd836b-hvf2_firmware","vivotek:fd836ba-ehtv_firmware","vivotek:fd836ba-ehvf2_firmware","vivotek:fd836ba-htv_firmware","vivotek:fd836ba-hvf2_firmware","vivotek:fd8377-ehtv_firmware","vivotek:fd8377-htv_firmware","vivotek:fd8377-hv_firmware","vivotek:fd8379-hv_firmware","vivotek:fd8382-etv_firmware","vivotek:fd8382-evf2_firmware","vivotek:fd8382-tv_firmware","vivotek:fd8382-vf2_firmware","vivotek:fd9165-ht-a_firmware","vivotek:fd9165-ht_firmware","vivotek:fd9166-hn_firmware","vivotek:fd9167-h_firmware","vivotek:fd9167-ht_firmware","vivotek:fd9171-ht_firmware","vivotek:fd9181-ht_firmware","vivotek:fd9187-h_firmware"],"source":"nvd","synced_at":"2026-10-19T21:05:42.039641217+00:00"},"epss":{"cve":"CVE-2020-11949","score":0.01194,"percentile":0.68043,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}