Unauthenticated Server-Side Request Forgery in BrightSign Digital Signage
CVE-2020-36884

6.9MEDIUM

Key Information:

Vendor

Brightsign, Llc

Status
Brightsign Digital Signage Diagnostic Web Server
Vendor
CVE Published:
10 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-36884?

The BrightSign Digital Signage Diagnostic Web Server version 8.2.26 and earlier contains a vulnerability that allows unauthenticated attackers to execute server-side request forgery (SSRF). By exploiting this flaw in the 'url' GET parameter of the Download Speed Test service, malicious actors can specify external domains, potentially bypassing firewalls and conducting unauthorized network enumeration. This can lead to the compromise of internal network hosts, enabling attackers to map network configurations and further plan their incursions.

Affected Version(s)

BrightSign Digital Signage Diagnostic Web Server 0 <= 8.2.26

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36884 - Proof of Concept

References

https://www.exploit-db.com/exploits/48843
exploit
https://www.brightsign.biz
product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-55...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2020-36884 : Unauthenticated Server-Side Request Forgery in BrightSign Digital Signage