CVE-2020-36920 iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control
Authenticated users can escalate privileges to full application takeover via insecure direct object references in console JavaScript functions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36920?
CVE-2020-36920 is a high-severity vulnerability in Yerootech iDS6 DSSPro Digital Signage System, published on 6 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
Weakness: CWE-863
Which versions are affected by CVE-2020-36920?
How do I fix CVE-2020-36920?
No fix has been published for CVE-2020-36920 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36920 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36920 exists.
Sources
Also known as GHSA-r855-vcgq-f3fh.