CVE-2020-36884 MEDIUM

CVE-2020-36884: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

Vendor Brightsign, Llc
Product BrightSign Digital Signage Diagnostic Web Server
Weakness CWE-918 · SSRF
Published December 10, 2025
Last update December 11, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

What the vulnerability does

01Description

BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET parameter of the Download Speed Test service. Attackers can specify external domains to bypass firewalls and perform network enumeration by forcing the application to make arbitrary HTTP requests to internal network hosts.

Key dates

02Disclosure timeline

December 10, 2025 CVE published
December 11, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-5260 SSRF in PozitifIK's Pik Online CVE-2026-10690 wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery CVE-2024-49312 WordPress Edwiser Bridge plugin <= 3.0.7 - Server Side Request Forgery (SSRF) vulnerability CVE-2024-10705 Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl CVE-2022-0939 Server-Side Request Forgery (SSRF) in janeczku/calibre-web