CVE-2020-37228
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 16, 2026
- Updated
- May 18, 2026
- Reserved
- May 15, 2026
Description
iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks against user accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected Products
| Product | Versions |
|---|---|
iDS6 DSSPro Digital Signage SystemYerootech |
|
References
- ExploitDB-48991exploit
- Vulnerability Advisoryvendor-advisory
- Official Product Homepageproduct
- VulnCheck Advisory: iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.