CVE-2020-36916: TDM Digital Signage Privilege Escalation

CVE-2020-36916 Overview

CVE-2020-36916 is a privilege escalation vulnerability affecting TDM Digital Signage PC Player version 4.1.0.4. The software contains insecure file permissions (CWE-732) that allow authenticated users to modify executable files. Attackers with local access can leverage these overly permissive "Modify" permissions to replace legitimate executable files with malicious binaries, ultimately gaining elevated system privileges.

Critical Impact

Local authenticated attackers can escalate privileges by replacing application executables with malicious binaries, potentially gaining SYSTEM-level access on affected digital signage systems.

Affected Products

• TDM Digital Signage PC Player 4.1.0.4
• Sony TDM Display Software (TDM-DS1Y, TDM-DS3Y)
• Digital signage deployments utilizing TDM PC Player software

Discovery Timeline

• 2026-01-06 - CVE CVE-2020-36916 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2020-36916

Vulnerability Analysis

This vulnerability stems from improper permission management within the TDM Digital Signage PC Player installation. The application configures file system permissions that grant authenticated users the ability to modify executable files that run with elevated privileges. When the TDM PC Player service or application executes, it runs these binaries with higher privileges than the authenticated user, creating a privilege escalation pathway.

Digital signage systems are particularly high-value targets for attackers as they often operate in public-facing locations with network connectivity, run continuously without direct supervision, and may have access to internal networks. The local attack vector requires the attacker to have initial authenticated access to the system, but once obtained, the insecure permissions provide a reliable path to full system compromise.

Root Cause

The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource). During installation, the TDM Digital Signage PC Player sets overly permissive access controls on its executable files and installation directory. Rather than restricting write access to administrative users only, the software grants "Modify" permissions to all authenticated users on the system. This violates the principle of least privilege and allows any local user to tamper with application binaries.

Attack Vector

The attack requires local access with authenticated user credentials. An attacker with a standard user account on a system running TDM Digital Signage PC Player can:

1. Navigate to the application installation directory
2. Identify executable files that run with elevated privileges (such as services or scheduled tasks)
3. Replace the legitimate binary with a malicious payload
4. Wait for the application or service to execute the modified binary with elevated privileges

This attack is particularly effective against digital signage systems that may have multiple user accounts for content management, or where physical access to the kiosk hardware is possible. The vulnerability is documented in Zero Science Lab advisory ZSL-2020-5604 and a proof-of-concept is available via Exploit-DB #48953.

Detection Methods for CVE-2020-36916

Indicators of Compromise

• Unauthorized modifications to executable files in the TDM Digital Signage PC Player installation directory
• Changes to file timestamps or hashes on application binaries without corresponding legitimate updates
• Unexpected processes spawning from TDM application executables
• Suspicious scheduled tasks or services associated with the signage player software

Detection Strategies

• Implement file integrity monitoring (FIM) on the TDM Digital Signage PC Player installation directory to detect unauthorized file modifications
• Monitor Windows Security Event logs for file access events (Event ID 4663) targeting application executables
• Deploy endpoint detection and response (EDR) solutions to identify binary replacement attempts and suspicious process behavior
• Review Access Control Lists (ACLs) on digital signage systems to identify overly permissive configurations

Monitoring Recommendations

• Configure real-time alerts for any write operations to executable files in signage application directories
• Establish baseline hashes of legitimate TDM PC Player binaries and validate regularly
• Monitor for privilege escalation indicators such as unexpected SYSTEM-level process creation from user context
• Review audit logs on digital signage endpoints during routine security assessments

How to Mitigate CVE-2020-36916

Immediate Actions Required

• Audit file permissions on TDM Digital Signage PC Player installation directories and restrict write access to administrators only
• Verify integrity of all executable files against known-good hashes from the vendor
• Implement application whitelisting to prevent unauthorized binary execution
• Review user accounts with access to digital signage systems and remove unnecessary privileges

Patch Information

Consult the vendor for updated versions of TDM Digital Signage PC Player that address the insecure permission configuration. Review the Sony TDM Display Software product page and TDM Signage homepage for security updates. Additional technical details are available through the VulnCheck Advisory and IBM X-Force Vulnerability Report.

Workarounds

• Manually correct file permissions using Windows ACL management to remove write access for non-administrative users
• Deploy endpoint protection solutions such as SentinelOne to detect and prevent binary tampering and privilege escalation attempts
• Isolate digital signage systems on dedicated network segments with restricted access
• Implement application control policies to prevent execution of modified or unsigned binaries

# Remediate insecure permissions on TDM installation directory (run as Administrator)
icacls "C:\Program Files\TDM Digital Signage PC Player" /inheritance:r
icacls "C:\Program Files\TDM Digital Signage PC Player" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\TDM Digital Signage PC Player" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\TDM Digital Signage PC Player" /grant:r "Users:(OI)(CI)RX"