CVE-2020-36897
Published: 10 December 2025
Summary
CVE-2020-36897 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Howfor Qihang Media Web Digital Signage. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36897 is an unauthenticated remote code execution vulnerability affecting QiHang Media Web Digital Signage version 3.0.9. The flaw resides in the QH.aspx file, where the file upload functionality can be abused via the 'remotePath' and 'fileToUpload' parameters. This allows attackers to upload malicious ASPX scripts, enabling the execution of arbitrary system commands on the server. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Any unauthenticated attacker with network access can exploit this vulnerability due to its low complexity and lack of required privileges or user interaction. Successful exploitation grants full remote code execution on the affected server, providing high confidentiality, integrity, and availability impacts. Attackers can write files to arbitrary locations and execute system commands, potentially leading to complete server compromise.
Advisories from VulnCheck and Zero Science document the issue, while an exploit is publicly available on Exploit-DB. No specific patches or mitigation details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30835
Vulnerability details
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to…
more
write and execute arbitrary system commands on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE via unrestricted file upload in public-facing web app (T1190); directly enables deployment and execution of malicious ASPX web shells (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted file upload flaw in QH.aspx by identifying, reporting, and correcting the vulnerability through timely patching or updates.
Validates 'remotePath' and 'fileToUpload' parameters to reject malicious ASPX scripts and prevent arbitrary command execution on the server.
Restricts classes of file upload inputs to safe types only, blocking unrestricted upload of dangerous executable ASPX files.