VULNERABILITY INTELLIGENCE

CVE-2020-36897

CVSS score9.8 CRITICAL

EPSS probability1.30%

CISA KEVNot currently listed

Published2025-12-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

Weakness classification

disclosure@vulncheck.com: CWE-434

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Third Party Advisory
disclosure@vulncheck.com — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory