CVE-2020-36900CWE-352

All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management

High · published December 10, 2025

CVSS v4.0
8.6
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

⚡ A simple crafted webpage is all it takes to give attackers the keys to your digital kingdom! 🚪💻 Think of it like a crafty magician at a party who hands out fake invitations to the VIP lounge. When a guest unknowingly visits the magician's illusion, suddenly, anyone with one of those invitations can gain access to the most exclusive areas, including the sensitive data and controls of your system! With this vulnerability, an attacker can create new administrative users without anyone being the wiser. That means they could potentially manipulate your entire digital signage system, throwing chaos into your operations or leaking sensitive information. It's not just a breach; it's an invitation to mayhem!

Put simply

Think of it like a crafty magician at a party who hands out fake invitations to the VIP lounge. When a guest unknowingly visits the magician's illusion, suddenly, anyone with one of those invitations can gain access to the most exclusive areas, including the sensitive data and controls of your system! CVE-2020-36900 is a cross-site request forgery (CSRF) vulnerability in All-Dynamics Digital Signage System 2.0.2. It allows attackers to execute unauthorized actions on behalf of users who are logged in, such as creating new users with global administrative privileges, due to the lack of proper request validation.

What to do

With this vulnerability, an attacker can create new administrative users without anyone being the wiser. That means they could potentially manipulate your entire digital signage system, throwing chaos into your operations or leaking sensitive information. It's not just a breach; it's an invitation to mayhem! To protect against this, update your All-Dynamics Digital Signage System to version 2.0.3 or later. Implement anti-CSRF tokens in your forms and review your security policies regarding user privileges and authentication. Don't underestimate the importance of form validation! You've got this! By following these steps, you'll lock down your system and keep the attackers at bay! 🛡️✨

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00273 · 18.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-10T21:04Z
EPSS history
Timeline
  • 10 DEC 21:04Z
    All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management
    cvelistv5