CVE-2020-36921
Published: 06 January 2026
Summary
CVE-2020-36921 is a high-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 46.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects information exposure through directory listings as unauthorized disclosure.
Directory listings and resource enumeration can be suppressed or populated with misleading entries.
Reduces exposure via directory listings or accessible files when OPSEC restricts visibility of key organizational resources.
NVD Description
RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive webserver log files. Attackers can visit multiple endpoints to retrieve system resources and debug log information without authentication.
Deeper analysisAI
CVE-2020-36921 is an information disclosure vulnerability affecting the RED-V Super Digital Signage System version 5.1.1. The flaw allows unauthenticated attackers to access sensitive webserver log files by visiting multiple endpoints, enabling retrieval of system resources and debug log information without any authentication requirements. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-548.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation grants high-impact confidentiality violations, potentially exposing sensitive system details, resources, and logs that could aid further attacks, though it has no impact on integrity or availability.
Advisories and references, including those from VulnCheck, CXSecurity, IBM X-Force Exchange, and PacketStorm, document the issue; the vendor site at https://www.red-v.tv/ may provide additional context. No specific patches or mitigations are detailed in the available information.
Details
- CWE(s)