CVE-2020-36901

HIGH

UBICOD Medivision Digital Signage 1.5.1 - CSRF

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-36901. PoCs published by LiquidWorm.

AI-analyzed exploit summary This is a CSRF exploit that adds a super admin user to UBICOD Medivision Digital Signage 1.5.1 by submitting a crafted POST request. The exploit leverages lack of CSRF protection to perform unauthorized administrative actions.

Description

UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappshardware
https://www.exploit-db.com/exploits/48694

This is a CSRF exploit that adds a super admin user to UBICOD Medivision Digital Signage 1.5.1 by submitting a crafted POST request. The exploit leverages lack of CSRF protection to perform unauthorized administrative actions.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: UBICOD Medivision Digital Signage 1.5.1
No auth needed
Prerequisites: Victim must be logged into the target application · Attacker must trick victim into visiting a malicious page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/48694
Product product
http://www.medivision.co.kr
Exploit, Third Party Advisory vendor-advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5574.php

Scores

CVSS v3 8.8
EPSS 0.0026
EPSS Percentile 16.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-352
Status published
Products (1)
medivision/medivision_digital_signage_firmware 1.5.1
Published Dec 10, 2025
Tracked Since Feb 18, 2026