CVE-2020-36896
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-17

Assigner: VulnCheck

Description
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-10
Last Modified
2025-12-17
Generated
2026-06-16
AI Q&A
2025-12-10
EPSS Evaluated
2026-06-15
NVD
CVE-2020-36896
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
howfor qihang_media_web_digital_signage 3.0.9
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in QiHang Media Web Digital Signage 3.0.9 allows unauthenticated attackers to access administrative login information because an unprotected XML file ('/xml/User/User.xml') contains cleartext credentials. Attackers can retrieve hardcoded admin credentials from this file, enabling them to bypass authentication directly.

Impact Analysis

The vulnerability can lead to unauthorized access to the administrative interface of the affected software. Attackers can use the exposed credentials to bypass authentication, potentially gaining full control over the system, which may result in data breaches, unauthorized changes, or disruption of services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-36896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart