CVE-2020-36920 json
iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control
published 2026-01-06 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-1019
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- exploit-db.com https://www.exploit-db.com/exploits/48992 referenced PoC, tagged "exploit" by a source, unverified
- packetstorm.news https://packetstorm.news/files/id/159918 referenced PoC, tagged "exploit" by a source, unverified
- cxsecurity.com https://cxsecurity.com/issue/WLB-2020110025 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Yerootech iDS6 DSSPro Digital Signage System
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
exploit-db.com
/exploits/48992
exploit
-
packetstorm.news
/files/id/159918
exploit
-
cxsecurity.com
/issue/WLB-2020110025
exploit
-
web.archive.org
/web/20200919100215/http://www.yerootech.com/
product
-
zeroscience.mk
/en/vulnerabilities/ZSL-2020-5608.php
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/191260
vdb-entry
-
vulncheck.com
/advisories/ids-dsspro-digital-signage-system-privilege-escalation-via-access-control
third-party-advisory
Sources
- CVE List CVE-2020-36920
- NVD CVE-2020-36920
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.