CVE-2020-36902 CRITICAL

CVE-2020-36902: UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges

Vendor Ubicod Co., Ltd. | Medivision Inc.
Product UBICOD Medivision Digital Signage
Weakness CWE-862 · Missing authorization
Published December 10, 2025
Last update December 11, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.

Key dates

02Disclosure timeline

December 10, 2025 CVE published
December 11, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-9219 Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update CVE-2025-31780 WordPress Append Content plugin <= 2.1.1 - CSRF to Settings Change vulnerability CVE-2024-55994 WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability CVE-2023-41873 WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability CVE-2024-44116 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform