CVE-2020-36902 PUBLISHED

UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges

Assigner: VulnCheck
Reserved: 09.12.2025 Published: 10.12.2025 Updated: 11.12.2025

UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor UBICOD Co., Ltd. | MEDIVISION INC.
Product UBICOD Medivision Digital Signage
Versions Default: unaffected
  • Version Firmware 1.5.1 (2013.01.3) is affected

Credits

  • LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

Problem Types

  • CWE-862: Missing Authorization CWE