CVE-2020-36921
Published: 06 January 2026
Summary
CVE-2020-36921 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2020-36921 is an information disclosure vulnerability affecting the RED-V Super Digital Signage System version 5.1.1. The flaw allows unauthenticated attackers to access sensitive webserver log files by visiting multiple endpoints, enabling retrieval of system resources and debug log information without any authentication requirements. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-548.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation grants high-impact confidentiality violations, potentially exposing sensitive system details, resources, and logs that could aid further attacks, though it has no impact on integrity or availability.
Advisories and references, including those from VulnCheck, CXSecurity, IBM X-Force Exchange, and PacketStorm, document the issue; the vendor site at https://www.red-v.tv/ may provide additional context. No specific patches or mitigations are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1020
Vulnerability details
RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive webserver log files. Attackers can visit multiple endpoints to retrieve system resources and debug log information without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote file/log access via public web endpoints enables T1190 (exploiting the exposed app) and T1005 (retrieving local system data).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 explicitly defines and limits permitted actions without identification or authentication, directly preventing unauthenticated access to sensitive webserver log endpoints exploited in this CVE.
SC-14 mandates protections for information associated with public web systems, restricting unauthorized access to sensitive logs and resources via exposed endpoints.
AC-3 enforces approved access authorizations and mechanisms, blocking unauthenticated retrieval of system resources and debug logs through web endpoints.