Vulnerability · Published Jan 6, 2026 · Assigned by VulnCheck

CVE-2020-36917iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie

High 7.5

In plain English

A high-severity security flaw in iDS6 DSSPro Digital Signage System from Guangzhou Yeroo Tech Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.

Affected products (as reported)

Vendor	Product	Versions
Guangzhou Yeroo Tech Co., Ltd.	iDS6 DSSPro Digital Signage System	V6.2 B2014.12.12.1220V5.6 B2017.07.12.1757V4.3

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Zero Science Lab Disclosure (ZSL-2020-5605) third-party-advisory
Packet Storm Security Exploit Entry exploit
IBM X-Force Vulnerability Exchange vdb-entry
CXSecurity Vulnerability Database Entry third-party-advisory
Archived Yeroo Tech Vendor Homepage product
VulnCheck Advisory: iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie third-party-advisory