Vulnerability · Published Dec 10, 2025 · Assigned by VulnCheck

CVE-2020-36895EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in i-Media Server Digital Signage from EIBIZ Co.,Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.

Affected products (as reported)

Vendor	Product	Versions
EIBIZ Co.,Ltd.	i-Media Server Digital Signage	0 – through 3.8.0

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

ExploitDB-48764 exploit
EIBIZ Co.,Ltd. Product Homepage product
Zero Security Advisory ZSL-2020-5583 vendor-advisory, vdb-entry
VulnCheck Advisory: EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure third-party-advisory