CVE-2020-36901 PUBLISHED

UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management

Assigner: VulnCheck
Reserved: 09.12.2025 Published: 10.12.2025 Updated: 11.12.2025

UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	Active

CVSS 4.0

Product Status

Vendor	UBICOD Co., Ltd. \| MEDIVISION INC.
Product	UBICOD Medivision Digital Signage
Versions	Default: unaffected Version Firmware 1.5.1 (2013.01.3) is affected

CVE-2020-36901 PUBLISHED

UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management

Metrics

Product Status

Credits

References

Problem Types