CVE-2020-36910
Published: 06 January 2026
Summary
CVE-2020-36910 is a high-severity OS Command Injection (CWE-78) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36910 is an authenticated remote command injection vulnerability (CWE-78) affecting Cayin Signage Media Player 3.0, specifically in the system.cgi and wizard_system.cgi pages. The flaw resides in the 'NTP_Server_IP' parameter, which attackers can exploit using default credentials to execute arbitrary shell commands as root. Published on 2026-01-06, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and potential for complete system compromise.
An attacker requires network access to the affected device and valid low-privilege credentials, such as the defaults provided by the software. Once authenticated, they can submit a malicious payload via the vulnerable 'NTP_Server_IP' parameter in the specified CGI pages, leading to remote code execution with root privileges. This grants high-impact control over confidentiality, integrity, and availability, allowing arbitrary command execution on the target system.
Advisories and additional details, including potential exploits, are documented in references such as https://cxsecurity.com/issue/WLB-2020060049, https://exchange.xforce.ibmcloud.com/vulnerabilities/182924, https://packetstorm.news/files/id/157942, https://www.cayintech.com, and https://www.exploit-db.com/exploits/48557. Security practitioners should consult these sources and the vendor for patch availability or mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1026
Vulnerability details
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated remote command injection in web CGI endpoints enables exploitation of public-facing application (T1190), arbitrary Unix shell execution (T1059.004), and privilege escalation from low-priv to root (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2020-36910 by identifying, patching, or updating the vulnerable CGI scripts to eliminate the command injection flaw.
Prevents exploitation of the NTP_Server_IP parameter by validating inputs to reject command injection payloads containing shell metacharacters.
Reduces attack surface by disabling default credentials or enforcing strong account management, hindering authenticated access needed to exploit the vulnerability.