CVE-2020-36915

Estado: AplazadaAlta (8.7)—

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.39%
Percentil entre todas las CVEs puntuadas: 30
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access90 %
Impacto secundarioT1059 Command and Scripting Interpreterexecution85 %

Credenciales hardcodeadas en aplicación web expuesta en red (AV:N, PR:N, UI:N) permiten acceso remoto no autenticado (T1078.001) y ejecución de comandos con permisos root (T1059). CWE-798 confirma credenciales débiles.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Password Policies Network Segmentation Multi-factor Authentication

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Adtec Digital — Signedje Digital Signage Player^AI

CWE

CWE-798, CWE-1392

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2020-36915",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-36915",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-06T19:42:21.293291Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Adtecdigital",
          "product": "SignEdje Digital Signage Player",
          "versions": [
            {
              "status": "affected",
              "version": "2.08.28"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "mediaHUB HD-Pro High & Standard Definition MPEG2 Encoder",
          "versions": [
            {
              "status": "affected",
              "version": "3.07.19"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "afiniti Multi-Carrier Platform",
          "versions": [
            {
              "status": "affected",
              "version": "1905_11"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "EN-31 Dual Channel DSNG Encoder / Modulator",
          "versions": [
            {
              "status": "affected",
              "version": "2.01.15"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "EN-210 Multi-CODEC 10-bit Encoder / Modulator",
          "versions": [
            {
              "status": "affected",
              "version": "3.00.29"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "EN-200 1080p AVC Low Latency Encoder / Modulator",
          "versions": [
            {
              "status": "affected",
              "version": "3.00.29"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "ED-71 10-bit / 1080p Integrated Receiver Decoder",
          "versions": [
            {
              "status": "affected",
              "version": "2.02.24"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "edje-5110 Standard Definition MPEG2 Encoder",
          "versions": [
            {
              "status": "affected",
              "version": "1.02.05"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "edje-4111 HD Digital Media Player",
          "versions": [
            {
              "status": "affected",
              "version": "2.07.09"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "Soloist HD-Pro Broadcast Decoder",
          "versions": [
            {
              "status": "affected",
              "version": "2.07.09"
            }
          ]
        },
        {
          "vendor": "Adtecdigital",
          "product": "adManage Traffic & Media Management Application",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-06T16:15:47.550",
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190628",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://packetstorm.news/files/id/159709",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.adtecdigital.com",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/48954",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/adtec-digital-signedje-digital-signage-player-default-credentials",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5603.php",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/48954",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        },
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions."
    },
    {
      "lang": "es",
      "value": "Adtec Digital SignEdje Digital Signage Player v2.08.28 contiene múltiples credenciales predeterminadas codificadas que permiten acceso remoto no autenticado a las interfaces web, telnet y SSH. Los atacantes pueden explotar estas credenciales para obtener acceso a nivel de root y ejecutar comandos del sistema en múltiples versiones de productos de Adtec Digital."
    }
  ],
  "lastModified": "2026-06-17T03:16:29.727",
  "sourceIdentifier": "disclosure@vulncheck.com"
}