CVE-2020-36914
Published: 06 January 2026
Summary
CVE-2020-36914 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 19.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-8 (Transmission Confidentiality and Integrity) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2020-36914 is a sensitive information disclosure vulnerability affecting QiHang Media Web Digital Signage version 3.0.9. The flaw arises from the transmission of user authentication credentials via cleartext cookies, which exposes these credentials to potential interception by unauthorized parties. This issue aligns with CWE-319 (Cleartext Transmission of Sensitive Information) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges or user interaction.
Remote attackers can exploit this vulnerability over the network with low attack complexity. By conducting man-in-the-middle (MITM) attacks, they can intercept the cleartext cookies containing authentication credentials during transmission, capture them, and potentially misuse them for unauthorized access or further compromise of the system.
Advisories detailing the vulnerability, including potential mitigation strategies, are available in the following references: https://cxsecurity.com/issue/WLB-2020080059, https://exchange.xforce.ibmcloud.com/vulnerabilities/186770, https://packetstormsecurity.com/files/158858, https://www.howfor.com/, and https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-cookie-authentication-credentials-disclosure. Security practitioners should review these sources for patch information or workarounds, such as enforcing HTTPS to prevent cleartext interception.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1023
Vulnerability details
QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through cleartext cookie transmission. Attackers can perform man-in-the-middle attacks to capture and potentially misuse stored authentication credentials transmitted in…
more
an insecure manner.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Cleartext cookie transmission directly enables network sniffing (T1040) and adversary-in-the-middle interception (T1557) to capture credentials for subsequent use.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires cryptographic protection for confidentiality of transmitted sensitive information, directly preventing interception of cleartext authentication credentials via MITM attacks.
Mandates management and protection of authenticator content from unauthorized disclosure, mitigating exposure of authentication credentials in cleartext cookies.
Implements cryptographic mechanisms to protect information in transit, countering the cleartext transmission vulnerability in authentication cookies.