CVE-2020-37228 CRITICAL

CVE-2020-37228: iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass

Vendor Yerootech
Product iDS6 DSSPro Digital Signage System
Weakness CWE-307 · Brute force
Published May 16, 2026
Last update May 18, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks against user accounts.

Key dates

02Disclosure timeline

May 16, 2026 CVE published
May 18, 2026 Record updated