CVE-2020-11949

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-28 · updated 2026-06-17

Description

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.

Affected products

Vivotek Cc8160(Hs) Firmware: through 0113b
Vivotek CC8160: through 0113b
Vivotek Cc8370-Hv Firmware: through 0213b
Vivotek Cc8371-Hv Firmware: through 0113b
Vivotek Cc9381-Hv Firmware: through 0222g
Vivotek Cd8371-Hntv Firmware: through 0113b
Vivotek Cd8371-Hnvf2 Firmware: through 0113b
Vivotek Fd8166A-N Firmware: through 0113b
Vivotek Fd8166A Firmware: through 0213b
Vivotek Fd8167A Firmware: through 0213b
Vivotek Fd8169A Firmware: through 0213b
Vivotek Fd816B-Hf2 Firmware: through 0113b
Vivotek Fd816B-Ht Firmware: through 0113b
Vivotek Fd816Ba-Hf2 Firmware: through 0113b
Vivotek Fd816Ba-Ht Firmware: through 0113b
Vivotek Fd816C-Hf2 Firmware: through 0213b
Vivotek Fd816Ca-Hf2 Firmware: through 0113b
Vivotek Fd8177-H Firmware: through 0113b
Vivotek Fd8177-Ht Firmware: through 0113b
Vivotek Fd8179-H Firmware: through 0113b
Vivotek Fd8182-F1 Firmware: through 0113b
Vivotek Fd8182-F2 Firmware: through 0113b
Vivotek Fd8182-T Firmware: through 0113b
Vivotek Fd8366-V Firmware: through 0113b
Vivotek Fd8367A-V Firmware: through 0213b
Vivotek Fd8369A-V Firmware: through 0213b
Vivotek Fd836B-Ehtv Firmware: through 0113b
Vivotek Fd836B-Ehvf2 Firmware: through 0113b
Vivotek Fd836B-Htv Firmware: through 0113b
Vivotek Fd836B-Hvf2 Firmware: through 0113b

References

Get alerted when CVE-2020-11949 or the next vulnerability affects your stack