CVE-2020-36886

CVE-2020-36886 is a cross-site request forgery (CSRF) vulnerability, mapped to CWE-352, in SpinetiX Fusion Digital Signage version 3.4.8. The issue stems from a lack of proper request validation, allowing attackers to create new administrative user accounts with full system privileges. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

An unauthenticated attacker (PR:N) can exploit this vulnerability by crafting a malicious webpage that automatically submits a form to the target system. When a logged-in user—typically an administrator—visits the page, the form submission creates a new admin account without the victim's knowledge or consent, granting the attacker full system access upon logging in with the new credentials. User interaction (UI:R) is required, but no special privileges are needed from the attacker.

Advisories and references detail the issue, including a proof-of-concept exploit at https://www.exploit-db.com/exploits/48846, vendor information at https://www.spinetix.com and https://www.spinetix.com/product/, a VulnCheck advisory at https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-cross-site-request-forgery-via-user-creation, and a Zero Science Labs report at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5592.php. These resources provide further guidance on the vulnerability, though specific patch or mitigation instructions are not detailed in the core description.