# QiHang Media Web Digital Signage has four flaws, including cleartext admin credentials

- Date: 2025-12-10
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2020-36896, CVE-2020-36897, CVE-2020-36898, CVE-2020-36899

NVD published 4 vulnerabilities in QiHang Media Web Digital Signage, covering authentication bypass, remote code execution, path traversal and a security flaw. In version 3.0.9, a cleartext credentials flaw lets unauthenticated attackers read administrative login information from an unprotected XML file.

## Sources

- [CVE-2020-36896](https://nvd.nist.gov/vuln/detail/CVE-2020-36896) (NIST NVD)
- [CVE-2020-36897](https://nvd.nist.gov/vuln/detail/CVE-2020-36897) (NIST NVD)
- [CVE-2020-36898](https://nvd.nist.gov/vuln/detail/CVE-2020-36898) (NIST NVD)
- [CVE-2020-36899](https://nvd.nist.gov/vuln/detail/CVE-2020-36899) (NIST NVD)
- [http://www.howfor.com](http://www.howfor.com)
- [https://www.exploit-db.com/exploits/48748](https://www.exploit-db.com/exploits/48748)

Page: https://signagelist.org/incidents/2025-12-qihang-media-web-digital-signage-has-four/