# Cayin Signage Media Player has an authenticated command injection flaw in two CGI pages

- Date: 2026-01-06
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2020-36910
- Products: [CAYIN](https://signagelist.org/products/cayin/)

NVD published a command injection flaw in Cayin Signage Media Player 3.0. The flaw is authenticated and remote, and it sits in the system.cgi and wizard_system.cgi pages.

## Sources

- [CVE-2020-36910](https://nvd.nist.gov/vuln/detail/CVE-2020-36910) (NIST NVD)
- [https://cxsecurity.com/issue/WLB-2020060049](https://cxsecurity.com/issue/WLB-2020060049)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/182924](https://exchange.xforce.ibmcloud.com/vulnerabilities/182924)

Page: https://signagelist.org/incidents/2026-01-cayin-signage-media-player-has-an-authenticated/