CVE-2020-36923

CriticalPublic PoC

Published: 06 January 2026

Published

06 January 2026

Modified

22 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0024 46.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-36923 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Sony Bravia Signage. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-14 (Public Access Protections).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to system resources, directly preventing IDOR bypasses of client-side restrictions via server-side checks.

SC-14 Public Access Protections good match

prevent

Protects publicly accessible interfaces from unauthorized use, mitigating network-exploitable unauthenticated access to hidden resources like '/#/content-creation'.

SI-10 Information Input Validation partial match

prevent

Validates manipulated inputs such as object references, reducing the risk of insecure direct object reference exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The IDOR vulnerability in the Sony BRAVIA Digital Signage web interface allows unauthenticated remote attackers to bypass authorization and access hidden system resources, directly mapping to exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

Deeper analysisAI

CVE-2020-36923 is an insecure direct object reference vulnerability (CWE-639) in Sony BRAVIA Digital Signage version 1.7.8. The flaw enables attackers to bypass authorization controls by manipulating client-side access restrictions, allowing unauthorized access to hidden system resources such as '/#/content-creation'.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation can result in high impacts to confidentiality, integrity, and availability, as attackers gain access to restricted system resources.

Advisories and related resources for mitigation details are available at the following references: https://cxsecurity.com/issue/WLB-2020120031, https://exchange.xforce.ibmcloud.com/vulnerabilities/192607, https://packetstormsecurity.com/files/160344, https://pro-bravia.sony.net, and https://pro-bravia.sony.net/resources/software/bravia-signage/.