What is the CVSS score of CVE-2020-36923?

CVE-2020-36923 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bravia Signage are affected by CVE-2020-36923?

Organizations using Sony BRAVIA Digital Signage 1.7.8 face critical risk from CVE-2020-36923, a IDOR vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2020-36923?

Yes, a public proof-of-concept exploit is available for CVE-2020-36923. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2020-36923?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Bravia Signage CVE-2020-36923

CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-01-06 disclosure@vulncheck.com

Authentication Bypass Bravia Signage Sony

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 22, 2026 - 21:15 vuln.today

Public exploit code

CVE Published

Jan 06, 2026 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

AnalysisAI

Sony BRAVIA Digital Signage 1.7.8 has an IDOR vulnerability that allows attackers to access hidden system resources like /#/content-creation by bypassing client-side access restrictions. PoC available.

Technical ContextAI

Access controls are implemented only on the client side (CWE-639). Direct URL navigation to restricted resources like /#/content-creation works without server-side authorization checks. This provides access to content management and potentially device configuration.

RemediationAI

Contact Sony for firmware updates. Implement network-level access controls to restrict management interface access. Move signage management to an isolated VLAN.