CVE-2020-36902
CriticalSummary
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.
Risk Assessment
The risk includes unauthorized access to administrative functions, potentially leading to full system compromise.
Recommendation
Immediately upgrade UBICOD Medivision Digital Signage to the latest version and implement proper access controls.
Original NVD description (English source)
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.