CVE-2020-36884

MediumPublished

BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

Published: Dec 10, 2025
Updated: Dec 11, 2025
Assigning CNA: VulnCheck

Primary CVSS

6.9/ 10Medium

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS probability estimate

1.1%

Low · next 30 days

Percentile: 66.1%
Model date: Nov 2, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET parameter of the Download Speed Test service. Attackers can specify external domains to bypass firewalls and perform network enumeration by forcing the application to make arbitrary HTTP requests to internal network hosts.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

BrightSign Digital Signage 8.2.26 - Server-Side Request ForgeryTemplate
http/cves/2020/CVE-2020-36884.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 6f886171c0a2Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.