CVE-2020-36888 SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script
Attackers can enumerate valid user accounts in SpinetiX Fusion Digital Signage by analyzing login error responses, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36888?
CVE-2020-36888 is a medium-severity vulnerability in SpenetiX AG Fusion Digital Signage, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
Weakness: CWE-203
Which versions are affected by CVE-2020-36888?
It affects 1 product.
Products include Spinetix Fusion Digital Signage.
How do I fix CVE-2020-36888?
No fix has been published for CVE-2020-36888 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36888 exists.
Other vulnerabilities in SpenetiX AG Fusion Digital Signage
Sources
Also known as GHSA-vhvc-4f6p-xp27.