What’s Vulnerable › Vulnerabilities

CVE-2020-36895: EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-10 · updated 2026-06-17
• Weakness: CWE-639

Description

EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.

Affected products

• EIBIZ Co.,Ltd. i-Media Server Digital Signage: 3.8.0

References

• http://www.eibiz.co.th
• https://www.exploit-db.com/exploits/48764
• https://www.vulncheck.com/advisories/eibiz-i-media-server-digital-signage-unauthenticated-configuration-disclosure
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5583.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5583.php

Get alerted when CVE-2020-36895 or the next vulnerability affects your stack