Medivision Digital Signage CVEs and Security Vulnerabilities

CVE-2020-36902

UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges

UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Medivision

Products

Digital Signage Medivision Digital Signage Medivision Digital Signage Firmware

CVE-2020-36901

UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management

UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed