BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-17

Assigner: VulnCheck

Description

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-17

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2020-36897

Affected Vendors & Products

Vendor	Product	Version / Range
howfor	qihang_media_web_digital_signage	3.0.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in QiHang Media Web Digital Signage 3.0.9, specifically in the QH.aspx file. It allows an unauthenticated attacker to remotely execute code by uploading malicious ASPX scripts through the file upload functionality. The attacker exploits the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

Impact Analysis

An attacker exploiting this vulnerability can execute arbitrary system commands on the affected server without authentication. This can lead to full compromise of the server, including data theft, data loss, service disruption, or using the server as a foothold for further attacks.

Hi! I’m here to help you understand CVE-2020-36897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70