CVE-2020-36923

MEDIUM EPSS 55.9%

Published Jan 6, 20265mo ago · Modified Jun 17, 20262w ago

6.9 CVSS 4.0

Medium

Published Jan 6, 2026 5mo ago

Last Modified Jun 17, 2026 2w ago

Description

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

CVSS Details

Base Score

6.9

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

55.9% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-639

Affected Products 1

Vendor	Product	Version	Range
sony	bravia_signage	*	≤1.7.8

References 9

cxsecurity.com https://cxsecurity.com/issue/WLB-2020120031

Third Party Advisory
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/192607

Third Party Advisory
packetstormsecurity.com https://packetstormsecurity.com/files/160344

Third Party Advisory
pro-bravia.sony.net https://pro-bravia.sony.net

Product
pro-bravia.sony.net https://pro-bravia.sony.net/resources/software/bravia-signage/

Product
pro.sony https://pro.sony/ue_US/products/display-software

Product
vulncheck.com https://www.vulncheck.com/advisories/sony-bravia-digital-signage-client-side-protection-bypass-via-idor

Third Party Advisory
zeroscience.mk https://www.zeroscience.mk/codes/sonybravia_idor.txt

Third Party Advisory
zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5611.php

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.