CVE-2020-36896 QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure
Unauthenticated attackers can retrieve hardcoded admin credentials from an unprotected XML file, enabling direct authentication bypass and full system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36896?
CVE-2020-36896 is a high-severity vulnerability in Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
Weakness: CWE-522
Which versions are affected by CVE-2020-36896?
It affects 1 product.
Products include Howfor Qihang Media Web Digital Signage.
How do I fix CVE-2020-36896?
No fix has been published for CVE-2020-36896 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36896 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36896 exists.
Other vulnerabilities in Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage
Sources
Also known as GHSA-7584-j7hq-mfh2.