VulnerabilityAnalyzed
CVE-2020-36922
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints.
MEDIUM 6.9EPSS 0.63%
Does this matter?
Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own.
Description
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-497
- Affected
- sony/bravia signage
- Source
- disclosure@vulncheck.com
References
- https://cxsecurity.com/issue/WLB-2020120028Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/192606Third Party Advisory
- https://packetstorm.news/files/id/160343Third Party Advisory
- https://pro-bravia.sony.netProduct
- https://pro-bravia.sony.net/resources/software/bravia-signage/Product
- https://pro.sony/ue_US/products/display-softwareProduct
- https://www.exploit-db.com/exploits/49187Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/sony-bravia-digital-signage-unauthenticated-system-api-information-disclosureThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5610.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.