CVE-2020-36922

High

Published: 06/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The vulnerability in Sony BRAVIA Digital Signage 1.7.8 allows unauthenticated attackers to access sensitive system information through exposed API endpoints. Attackers can retrieve network interface details, server configurations, and system metadata.

Risk Assessment

The risk involves disclosure of infrastructure details, which may facilitate further attacks such as network reconnaissance, detection of vulnerable services, or preparation of targeted exploits. Lack of authentication increases the attack surface.

Recommendation

It is recommended to immediately restrict access to API endpoints (e.g., via firewall or access control lists) and update the software to the latest version if a patch is available. Also monitor logs for unauthorized API requests.

Other vulnerabilities in Sony BRAVIA Digital Signage

CVE-2020-36923Critical
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

Original NVD description (English source)

Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.