# UBICOD Medivision Digital Signage CSRF flaw lets attackers create administrative accounts

- Date: 2025-12-10
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2020-36901, CVE-2020-36902

NVD published 2 vulnerabilities in UBICOD Medivision Digital Signage, covering CSRF and privilege escalation. In version 1.5.1, a cross-site request forgery flaw lets attackers create administrative user accounts without proper request validation.

## Sources

- [CVE-2020-36901](https://nvd.nist.gov/vuln/detail/CVE-2020-36901) (NIST NVD)
- [CVE-2020-36902](https://nvd.nist.gov/vuln/detail/CVE-2020-36902) (NIST NVD)
- [http://www.medivision.co.kr](http://www.medivision.co.kr)
- [https://www.exploit-db.com/exploits/48694](https://www.exploit-db.com/exploits/48694)

Page: https://signagelist.org/incidents/2025-12-ubicod-medivision-digital-signage-csrf-flaw-lets/