CVE-2020-36892

Critical · 9.8

CVSS

9.8

EPSS

1.1%

Published

Dec 10, 2025

CISA due date

—

The record

Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.

Affected packages

Ecosystem	Package	Introduced	Fixed