CVE-2020-36898

HighPublic PoC

Published: 10 December 2025

Published

10 December 2025

Modified

17 December 2025

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.1626 95.0th percentile

Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-36898 is a high-severity Path Traversal (CWE-22) vulnerability in Howfor Qihang Media Web Digital Signage. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2020-36898 is an unauthenticated arbitrary file deletion vulnerability in QiHang Media Web Digital Signage version 3.0.9. The flaw resides in the QH.aspx endpoint, where remote attackers can exploit the 'data' parameter via a POST request containing directory traversal sequences to delete arbitrary files using the web server's permissions.

Any remote attacker can exploit this vulnerability without authentication (PR:N). Successful exploitation enables deletion of critical files, resulting in high integrity (I:H) and availability (A:H) impacts but no confidentiality loss (C:N), as reflected in its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U). The issue stems from CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Advisories from VulnCheck (https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion), Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php), and an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/48749) provide additional technical details. Security practitioners should review these sources for recommended mitigations.

A public exploit is available on Exploit-DB, indicating practical exploitability despite the CVE's publication on 2025-12-10.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-30834

Vulnerability details

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to…

delete arbitrary files with web server permissions using directory traversal sequences.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of public-facing web application via directory traversal (T1190) enables arbitrary file deletion for disruption and data destruction (T1107).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0