CVE-2020-36920
iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control
- State
- Published
- Severity
- 8.7 High
- Published
- Jan 6, 2026
- Updated
- Jan 6, 2026
- Reserved
- Jan 3, 2026
Description
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
iDS6 DSSPro Digital Signage SystemYerootech |
|
References
- ExploitDB-48992exploit
- Archived Yeroo Tech Vendor Homepageproduct
- Zero Science Lab Disclosure (ZSL-2020-5608)third-party-advisory
- Packet Storm Security Exploit Entryexploit
- CXSecurity Vulnerability Database Entryexploit
- IBM X-Force Vulnerability Exchangevdb-entry
- VulnCheck Advisory: iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Controlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.