CVE-2020-36896 | BDVDB-2026-305124 Detail
Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation TechnologyQiHang Media Web Digital Signage
Description#
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
Impact#
Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-522 Insufficiently Protected Credentials
References#
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.