CVE-2020-36902 is a critical (CVSS 9.8) authorization bypass in UBICOD Medivision Digital Signage 1.5.1. A GET request to /html/user with the ft[grp] parameter set to the integer 3 grants super admin rights. No fixed version is confirmed, so restrict access to the interface.
What's affected
UBICOD Medivision Digital Signage firmware version 1.5.1, listed by VulnCheck as 1.5.1 (2013.01.3), per the record and its advisory.
The record says the flaw is an authorization bypass: normal users can escalate privileges by manipulating the ft[grp] parameter. The record's wording says users gain super admin rights without authentication, while its first sentence refers to normal users, so the exact starting privilege is ambiguous. Treat the interface as open to anyone who can reach it.
I could not confirm a fixed release. The vendor's site is linked in the record. Signage systems are often set up by an installer and then left alone, so ask who administers yours and when the firmware was last reviewed.
How to check if you're exposed
Read the firmware version from the signage system's admin page. 1.5.1 is in scope.
Then check who can reach the web interface:
nmap -sV -p 80,443 <device-address>
Review the user list for unexpected super admin accounts or role changes. Check web server logs for requests to the user page with unusual parameters from unfamiliar addresses.
If the device is reachable from the internet, plan to change that first. Signage devices rarely need to be.
What to do now
- Find all Medivision signage devices and their firmware versions.
- Contact the vendor for a fix.
- Limit the web interface to the administrator addresses that need it, and remove it from the internet.
- Review accounts and remove unexpected super admins. Reset administrator passwords.
- Place signage devices on a separate network segment.
Why it matters
The record classes this as CWE-862 (Missing Authorization). The application lets the caller specify the group they belong to, and the server accepts the value. Role and group membership must be set by the server from trusted data, never taken from a request.
This pattern is sometimes called mass assignment or parameter tampering. The fix is boring: decide on the server which fields a user may change, and ignore the rest. Every privilege decision belongs on the server side.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Which firmware is affected?
The record and VulnCheck name 1.5.1. No other versions are listed.
What does the attacker gain?
Super admin rights in the signage management interface, per the record.
Sources
Last reviewed: 19 October 2026.
