Vulnerability-Lookup

GHSA-CRVX-WH2G-R65C

Vulnerability from github – Published: 2026-01-06 18:31 – Updated: 2026-01-06 18:31

Details

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-36915"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-06T16:15:47Z",
    "severity": "HIGH"
  },
  "details": "Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.",
  "id": "GHSA-crvx-wh2g-r65c",
  "modified": "2026-01-06T18:31:34Z",
  "published": "2026-01-06T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36915"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190628"
    },
    {
      "type": "WEB",
      "url": "https://packetstorm.news/files/id/159709"
    },
    {
      "type": "WEB",
      "url": "https://www.adtecdigital.com"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/48954"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/adtec-digital-signedje-digital-signage-player-default-credentials"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5603.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2020-36915 (GCVE-0-2020-36915)

Vulnerability from cvelistv5 – Published: 2026-01-06 15:52 – Updated: 2026-01-06 19:42

Title

Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials

Summary

Severity ?

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-798 - Use of Hard-coded Credentials
CWE-1392 - Use of Default Credentials

Assigner

VulnCheck

References

URL

Tags

	https://www.exploit-db.com/exploits/48954	exploit
	https://www.adtecdigital.com	product
	https://www.zeroscience.mk/en/vulnerabilities/ZSL…	third-party-advisory
	https://packetstorm.news/files/id/159709	exploit
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entry
	https://www.vulncheck.com/advisories/adtec-digita…	third-party-advisory

Impacted products

Vendor

Product

Version

Adtecdigital

SignEdje Digital Signage Player

Affected: 2.08.28

Adtecdigital	mediaHUB HD-Pro High & Standard Definition MPEG2 Encoder	Affected: 3.07.19
Adtecdigital	afiniti Multi-Carrier Platform	Affected: 1905_11
Adtecdigital	EN-31 Dual Channel DSNG Encoder / Modulator	Affected: 2.01.15
Adtecdigital	EN-210 Multi-CODEC 10-bit Encoder / Modulator	Affected: 3.00.29
Adtecdigital	EN-200 1080p AVC Low Latency Encoder / Modulator	Affected: 3.00.29
Adtecdigital	ED-71 10-bit / 1080p Integrated Receiver Decoder	Affected: 2.02.24
Adtecdigital	edje-5110 Standard Definition MPEG2 Encoder	Affected: 1.02.05
Adtecdigital	edje-4111 HD Digital Media Player	Affected: 2.07.09
Adtecdigital	Soloist HD-Pro Broadcast Decoder	Affected: 2.07.09
Adtecdigital	adManage Traffic & Media Management Application	Affected: 2.5.4

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-36915",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T19:42:21.293291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:42:42.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/48954"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SignEdje Digital Signage Player",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.08.28"
            }
          ]
        },
        {
          "product": "mediaHUB HD-Pro High \u0026 Standard Definition MPEG2 Encoder",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "3.07.19"
            }
          ]
        },
        {
          "product": "afiniti Multi-Carrier Platform",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "1905_11"
            }
          ]
        },
        {
          "product": "EN-31 Dual Channel DSNG Encoder / Modulator",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.01.15"
            }
          ]
        },
        {
          "product": "EN-210 Multi-CODEC 10-bit Encoder / Modulator",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "3.00.29"
            }
          ]
        },
        {
          "product": "EN-200 1080p AVC Low Latency Encoder / Modulator",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "3.00.29"
            }
          ]
        },
        {
          "product": "ED-71 10-bit / 1080p Integrated Receiver Decoder",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.02.24"
            }
          ]
        },
        {
          "product": "edje-5110 Standard Definition MPEG2 Encoder",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "1.02.05"
            }
          ]
        },
        {
          "product": "edje-4111 HD Digital Media Player",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.07.09"
            }
          ]
        },
        {
          "product": "Soloist HD-Pro Broadcast Decoder",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.07.09"
            }
          ]
        },
        {
          "product": "adManage Traffic \u0026 Media Management Application",
          "vendor": "Adtecdigital",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"
        }
      ],
      "datePublic": "2020-07-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-1392",
              "description": "Use of Default Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T15:52:24.350Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-48954",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/48954"
        },
        {
          "name": "Adtec Digital Official Homepage",
          "tags": [
            "product"
          ],
          "url": "https://www.adtecdigital.com"
        },
        {
          "name": "Zero Science Lab Disclosure (ZSL-2020-5603)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5603.php"
        },
        {
          "name": "Packet Storm Security Exploit Entry",
          "tags": [
            "exploit"
          ],
          "url": "https://packetstorm.news/files/id/159709"
        },
        {
          "name": "IBM X-Force Vulnerability Exchange",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190628"
        },
        {
          "name": "VulnCheck Advisory: Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/adtec-digital-signedje-digital-signage-player-default-credentials"
        }
      ],
      "title": "Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-36915",
    "datePublished": "2026-01-06T15:52:24.350Z",
    "dateReserved": "2026-01-03T14:10:13.301Z",
    "dateUpdated": "2026-01-06T19:42:42.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-CRVX-WH2G-R65C

CVE-2020-36915 (GCVE-0-2020-36915)

Tags

Sightings

Nomenclature