PT-2025-50515 · Eibiz · Mediaserver

Published 2025-12-10 · Updated 2025-12-11 · CVE-2020-36894

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eibiz i-Media Server Digital Signage version 3.8.0

Description The software contains an authentication bypass that allows unauthenticated attackers to create administrative users. This is achieved through manipulation of AMF-encoded objects sent to the /messagebroker/amf API endpoint. Attackers can bypass security controls and create admin users without needing to authenticate. The vulnerability involves sending crafted serialized objects to the specified endpoint.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /messagebroker/amf API endpoint.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-36894

Affected Products

Mediaserver

References · 8

• 🔥 https://exploit-db.com/exploits/48763 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5586.php · Exploit
• https://osv.dev/vulnerability/CVE-2020-36894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36894 · Security Note
• https://twitter.com/CVEnew/status/1999108933240467903 · Twitter Post
• https://t.me/CVEtracker/39399 · Telegram Post
• http://eibiz.co.th · Note
• https://vulncheck.com/advisories/eibiz-i-media-server-digital-signage-unauthenticated-user-creation-vulnerability · Note