CVE-2020-36902

UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges

UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.

Affected

UBICOD Co., Ltd. | MEDIVISION INC. · UBICOD Medivision Digital Signage

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.14% chance of exploitation in the next 30 days, 66th percentile

Published

2025-12-10

Updated

2025-12-11

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48684

Security advisories

• https://www.vulncheck.com/advisories/ubicod-medivision-digital-signage-authorization-bypa…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5575.php
• http://www.medivision.co.kr

References

• CVE Record
• NVD entry