Vulnerability · Published Jan 6, 2026 · Assigned by VulnCheck
CVE-2020-36923Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR
Critical 9.8
In plain English
A critical-severity authorization bypass via user-controlled key in Sony BRAVIA Digital Signage from Sony Electronics Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sony Electronics Inc. | Sony BRAVIA Digital Signage | <=1.7.8 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Zero Science Lab Disclosure (ZSL-2020-5611) third-party-advisory
- IBM X-Force Exchange Vulnerability Entry vdb-entry
- CXSecurity Vulnerability Listing third-party-advisory
- Packet Storm Security Exploit Archive exploit
- Sony Professional Display Software Product Page product
- BRAVIA Signage Software Resources product
- Sony BRAVIA Digital Signage Official Homepage product
- VulnCheck Advisory: Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR third-party-advisory
- https://www.zeroscience.mk/codes/sonybravia_idor.txt exploit