Cross-Site Request Forgery Vulnerability in SpinetiX Fusion Digital Signage
CVE-2020-36886

6.9MEDIUM

Key Information:

Vendor

Spenetix Ag

Status
Fusion Digital Signage
Vendor
CVE Published:
10 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-36886?

The SpinetiX Fusion Digital Signage version 3.4.8 has a vulnerability that allows malicious actors to exploit cross-site request forgery (CSRF) attacks. By enticing logged-in users to visit a crafted web page, an attacker can automatically create an administrative account without proper request validation. This poses a significant risk as it grants unauthorized users full system privileges, potentially leading to further security breaches.

Affected Version(s)

Fusion Digital Signage 0 <= 8.2.26

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36886 - Proof of Concept

References

https://www.exploit-db.com/exploits/48846
exploit
https://www.spinetix.com
product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-55...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2020-36886 : Cross-Site Request Forgery Vulnerability in SpinetiX Fusion Digital Signage