CVE-2020-36920
Published: 06 January 2026
Summary
CVE-2020-36920 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-2 (Account Management).
Deeper analysis
CVE-2020-36920 is an improper access control vulnerability (CWE-863) in the iDS6 DSSPro Digital Signage System version 6.2. The flaw allows authenticated users to elevate privileges through console JavaScript functions by exploiting insecure direct object references, enabling actions such as creating users, modifying roles and permissions, and potentially achieving full application takeover.
Attackers require low-privileged authenticated access (PR:L) to exploit this remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as reflected in its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants high impacts on confidentiality, integrity, and availability, allowing privilege escalation to administrative control.
Advisories and references documenting the vulnerability and potential mitigations include CXSecurity (https://cxsecurity.com/issue/WLB-2020110025), IBM X-Force Exchange (https://exchange.xforce.ibmcloud.com/vulnerabilities/191260), PacketStorm (https://packetstorm.news/files/id/159918), an archived YeRoo Technologies site (https://web.archive.org/web/20200919100215/http://www.yerootech.com/), and Exploit-DB (https://www.exploit-db.com/exploits/48992). Security practitioners should review these sources for patch availability and remediation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1019
Vulnerability details
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure…
more
direct object references.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to exploitation of access control/IDOR flaw for privilege escalation (T1068) and account/role manipulation to achieve admin takeover (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly preventing privilege escalation via insecure direct object references in console JavaScript functions.
Employs least privilege principle to limit the impact of unauthorized access and privilege elevation achieved through the vulnerability.
Manages accounts, roles, and permissions to restrict unauthorized creation of users and modification of privileges exploited by the IDOR vulnerability.