CVE-2020-36918

🗓️ 06 Jan 2026 15:52:25Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Cross-Site Request Forgery in iDS6 DSSPro Digital Signage System 6.2 lets attackers trick administrators into adding users.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2020-36918	6 Jan 202616:10	–	circl
CNNVD	Phoenix Contact iDS6 DSSPro 安全漏洞	6 Jan 202600:00	–	cnnvd
Cvelist	CVE-2020-36918 iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management	6 Jan 202615:52	–	cvelist
EUVD	EUVD-2026-1018	6 Jan 202615:52	–	euvd
NVD	CVE-2020-36918	6 Jan 202616:15	–	nvd
Positive Technologies	PT-2026-1452	6 Jan 202600:00	–	ptsecurity
Vulnrichment	CVE-2020-36918 iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management	6 Jan 202615:52	–	vulnrichment
Zero Science Lab	iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery (CSRF)	4 Nov 202000:00	–	zeroscience

Vulners

Node

yerootech ids6_dsspro_digital_signage_systemMatch6.2_b2014.12.12.1220

yerootech ids6_dsspro_digital_signage_systemMatch5.6_b2017.07.12.1757

yerootech ids6_dsspro_digital_signage_systemMatch4.3

[
  {
    "vendor": "Yerootech",
    "product": "iDS6 DSSPro Digital Signage System",
    "versions": [
      {
        "version": "6.2 B2014.12.12.1220",
        "status": "affected"
      },
      {
        "version": "5.6 B2017.07.12.1757",
        "status": "affected"
      },
      {
        "version": "4.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-cross-site-request-forgery-via-user-management
web	www.web.archive.org/web/20200919100215/http://www.yerootech.com/
packetstormsecurity	www.packetstormsecurity.com/files/159916
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/191258
exploit-db	www.exploit-db.com/exploits/48990
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5606.php
cxsecurity	www.cxsecurity.com/issue/WLB-2020110022

Parameter	Position	Path	Description	CWE
user.userName	request body	192.168.1.88/Pages/user!addUser	CSRF flaw enabling action execution via forged requests to add a user (admin action) without proper request validation.	CWE-352
user.password	request body	192.168.1.88/Pages/user!addUser	CSRF flaw enabling action execution via forged requests to add a user (admin action) without proper request validation.	CWE-352

17 Jun 2026 03:16Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.14.3

CVSS 45.1

EPSS0.00142

SSVC

CWE-352