PT-2025-50514 · Eibiz · I-Media Server Digital Signage

Published 2025-12-10 · Updated 2025-12-11 · CVE-2020-36893

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eibiz i-Media Server Digital Signage version 3.8.0

Description The Eibiz i-Media Server Digital Signage software contains a directory traversal flaw. This allows attackers, without needing to log in, to access files that are outside of the intended server directory. Exploitation occurs through the oldfile GET parameter. Specifically, attackers can view sensitive configuration files, such as web.xml, and system files, like win.ini.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the oldfile GET parameter.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-36893

Affected Products

I-Media Server Digital Signage

References · 8

• 🔥 https://exploit-db.com/exploits/48766 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php · Exploit
• https://osv.dev/vulnerability/CVE-2020-36893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36893 · Security Note
• https://t.me/CVEtracker/39398 · Telegram Post
• https://twitter.com/CVEnew/status/1999108934444142694 · Twitter Post
• http://eibiz.co.th · Note
• https://vulncheck.com/advisories/eibiz-i-media-server-digital-signage-directory-traversal-vulnerability · Note