CVE-2020-36923

CRITICAL
2026-01-06 [email protected]
Authentication Bypass Bravia Signage
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Jan 22, 2026 - 21:15 vuln.today
Public exploit code
CVE Published
Jan 06, 2026 - 16:15 nvd
CRITICAL 9.8

DescriptionNVD

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

AnalysisAI

Sony BRAVIA Digital Signage 1.7.8 has an IDOR vulnerability that allows attackers to access hidden system resources like /#/content-creation by bypassing client-side access restrictions. PoC available.

Technical ContextAI

Access controls are implemented only on the client side (CWE-639). Direct URL navigation to restricted resources like /#/content-creation works without server-side authorization checks. This provides access to content management and potentially device configuration.

RemediationAI

Contact Sony for firmware updates. Implement network-level access controls to restrict management interface access. Move signage management to an isolated VLAN.

Share

CVE-2020-36923 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy