CVE-2020-36902 UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges
Attackers can escalate privileges to super admin by manipulating a parameter in a GET request, allowing unauthorized control of the digital signage system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36902?
CVE-2020-36902 is a critical vulnerability in UBICOD Medivision Digital Signage, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.
Weakness: CWE-862
Which versions are affected by CVE-2020-36902?
It affects 1 product.
Products include Medivision Medivision Digital Signage Firmware.
How do I fix CVE-2020-36902?
No fix has been published for CVE-2020-36902 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36902 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36902 exists.
Other vulnerabilities in UBICOD Medivision Digital Signage
Sources
Also known as GHSA-j4gw-33j8-8f5j.