Read the docs
TI-2013-05134 Aliases CVE-2013-6023GHSA-fg36-pjmc-c775

Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware…

Priority MEDIUM 47CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Complete · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbitrary files via .. (dot dot) in the URI.

Why it matters now

EPSS 0.10223 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:h:tvt:dvr:td-2308ss-b:-:*:*:*:*:*:*td-2308ss-bVulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:*:*:*:*:*:*:*:*up to 3.2.0.p-3520a-03VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.6.p-1.0.2.1-03:*:*:*:*:*:*:*3.1.6.p-1.0.2.1-03VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.7.b-1.0.2.1-00:*:*:*:*:*:*:*3.1.7.b-1.0.2.1-00VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.43.b:*:*:*:*:*:*:*3.1.43.bVulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.43.p:*:*:*:*:*:*:*3.1.43.pVulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.75.b-1.0.2.1-00:*:*:*:*:*:*:*3.1.75.b-1.0.2.1-00VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.81.b-1.0.2.1-00:*:*:*:*:*:*:*3.1.81.b-1.0.2.1-00VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.83.b-1.0.2.1-00:*:*:*:*:*:*:*3.1.83.b-1.0.2.1-00VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.83.p-1.0.4.2-03:*:*:*:*:*:*:*3.1.83.p-1.0.4.2-03VulnerableTVT
  • cpe:2.3:h:tvt:dvr:td-2308ss-b:-:*:*:*:*:*:* Versions td-2308ss-b Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:*:*:*:*:*:*:*:* Versions up to 3.2.0.p-3520a-03 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.6.p-1.0.2.1-03:*:*:*:*:*:*:* Versions 3.1.6.p-1.0.2.1-03 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.7.b-1.0.2.1-00:*:*:*:*:*:*:* Versions 3.1.7.b-1.0.2.1-00 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.43.b:*:*:*:*:*:*:* Versions 3.1.43.b Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.43.p:*:*:*:*:*:*:* Versions 3.1.43.p Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.75.b-1.0.2.1-00:*:*:*:*:*:*:* Versions 3.1.75.b-1.0.2.1-00 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.81.b-1.0.2.1-00:*:*:*:*:*:*:* Versions 3.1.81.b-1.0.2.1-00 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.83.b-1.0.2.1-00:*:*:*:*:*:*:* Versions 3.1.83.b-1.0.2.1-00 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.83.p-1.0.4.2-03:*:*:*:*:*:*:* Versions 3.1.83.p-1.0.4.2-03 Vulnerable ·TVT
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tvt:dvr_firmware:3.1.87.p-1.0.4.2-17:*:*:*:*:*:*:*3.1.87.p-1.0.4.2-17VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.91.p-1.0.2.1-03:*:*:*:*:*:*:*3.1.91.p-1.0.2.1-03VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.92.p-1.0.2.1-00:*:*:*:*:*:*:*3.1.92.p-1.0.2.1-00VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.1.93.b-1.0.2.1-17:*:*:*:*:*:*:*3.1.93.b-1.0.2.1-17VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.2.0.b-1.0.2.1-17:*:*:*:*:*:*:*3.2.0.b-1.0.2.1-17VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.2.1-03:*:*:*:*:*:*:*3.2.0.p-1.0.2.1-03VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.2.1-17:*:*:*:*:*:*:*3.2.0.p-1.0.2.1-17VulnerableTVT
cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.6.0.32-00:*:*:*:*:*:*:*3.2.0.p-1.0.6.0.32-00VulnerableTVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.87.p-1.0.4.2-17:*:*:*:*:*:*:* Versions 3.1.87.p-1.0.4.2-17 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.91.p-1.0.2.1-03:*:*:*:*:*:*:* Versions 3.1.91.p-1.0.2.1-03 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.92.p-1.0.2.1-00:*:*:*:*:*:*:* Versions 3.1.92.p-1.0.2.1-00 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.1.93.b-1.0.2.1-17:*:*:*:*:*:*:* Versions 3.1.93.b-1.0.2.1-17 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.2.0.b-1.0.2.1-17:*:*:*:*:*:*:* Versions 3.2.0.b-1.0.2.1-17 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.2.1-03:*:*:*:*:*:*:* Versions 3.2.0.p-1.0.2.1-03 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.2.1-17:*:*:*:*:*:*:* Versions 3.2.0.p-1.0.2.1-17 Vulnerable ·TVT
  • cpe:2.3:o:tvt:dvr_firmware:3.2.0.p-1.0.6.0.32-00:*:*:*:*:*:*:* Versions 3.2.0.p-1.0.6.0.32-00 Vulnerable ·TVT

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6023
  2. 2026-10-03 Alias added: GHSA-fg36-pjmc-c775

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences