CVE-2020-36917: iDS6 DSSPro Information Disclosure Flaw

CVE-2020-36917 Overview

CVE-2020-36917 is a sensitive information disclosure vulnerability affecting iDS6 DSSPro Digital Signage System 6.2. The vulnerability allows remote attackers positioned on the same network segment to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.

Critical Impact

Authentication credentials transmitted in cleartext cookies can be intercepted by network-adjacent attackers, leading to complete account compromise and unauthorized system access.

Affected Products

• iDS6 DSSPro Digital Signage System 6.2

Discovery Timeline

• 2026-01-06 - CVE-2020-36917 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2020-36917

Vulnerability Analysis

This vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) exists within the iDS6 DSSPro Digital Signage System's authentication mechanism. The system's autoSave feature stores user credentials, including passwords, in browser cookies without encryption or secure transport protections. When users authenticate to the digital signage management interface, their credentials are transmitted in plaintext over HTTP connections, making them susceptible to interception.

The adjacent network attack vector means that an attacker must be positioned on the same local network segment as the victim to successfully intercept the cleartext credentials. This could include shared corporate networks, public Wi-Fi environments, or compromised network infrastructure where the digital signage system operates.

Root Cause

The root cause stems from improper security design in the credential handling mechanism. The application fails to implement secure cookie attributes (such as the Secure flag requiring HTTPS transmission) and stores sensitive authentication data in cookies without encryption. The autoSave functionality compounds this issue by persisting credentials in an insecure manner, creating a persistent attack surface for credential theft.

Attack Vector

An attacker on the same network segment can perform a man-in-the-middle (MitM) attack against HTTP traffic between users and the iDS6 DSSPro system. Using network sniffing tools or ARP spoofing techniques, the attacker intercepts HTTP requests containing authentication cookies. Since the autoSave feature stores passwords in cleartext within these cookies, the attacker can extract valid credentials without any decryption requirements.

The attack requires no authentication or special privileges on the target system, and no user interaction beyond normal system usage is necessary for exploitation. Once credentials are captured, the attacker gains full access to the digital signage management interface with the privileges of the compromised user account.

Detection Methods for CVE-2020-36917

Indicators of Compromise

• Network traffic analysis revealing cleartext credentials in HTTP cookie headers to/from the iDS6 DSSPro system
• Unauthorized access to digital signage management interfaces from unexpected network locations
• Multiple failed authentication attempts followed by successful logins from different source IPs
• ARP spoofing or network traffic anomalies near systems running iDS6 DSSPro

Detection Strategies

• Deploy network intrusion detection systems (IDS) to monitor for cleartext credential patterns in HTTP traffic
• Implement network flow analysis to identify potential MitM attack patterns and ARP spoofing attempts
• Monitor authentication logs for the iDS6 DSSPro system for anomalous login patterns or geographic impossibilities
• Use SentinelOne Singularity XDR to correlate network-based attacks with endpoint indicators

Monitoring Recommendations

• Enable comprehensive HTTP traffic logging for systems communicating with the iDS6 DSSPro application
• Configure alerts for unencrypted authentication traffic on network segments hosting digital signage infrastructure
• Implement network segmentation monitoring to detect unauthorized access to digital signage VLANs

How to Mitigate CVE-2020-36917

Immediate Actions Required

• Isolate iDS6 DSSPro systems to dedicated, secured network segments with restricted access
• Disable the autoSave feature in the application if possible to prevent credential storage in cookies
• Implement a reverse proxy or load balancer with TLS termination to encrypt all traffic to the digital signage system
• Reset all user credentials that may have been exposed through cleartext transmission

Patch Information

No vendor patch information is currently available for this vulnerability. Organizations should consult the VulnCheck Advisory and Zero Science Vulnerability ZSL-2020-5605 for the latest remediation guidance. Additional technical details are available from IBM X-Force Vulnerability #191261 and Packet Storm Security.

Workarounds

• Deploy a TLS-enabled reverse proxy in front of the iDS6 DSSPro system to encrypt all client communications
• Implement network-level encryption (IPsec or 802.1AE MACsec) on network segments hosting the vulnerable system
• Restrict network access to the digital signage system to trusted management workstations only
• Consider deploying VPN-only access requirements for administrative connections to the affected system

# Example nginx reverse proxy configuration for TLS termination
# Place this proxy in front of the iDS6 DSSPro system

server {
    listen 443 ssl;
    server_name signage.example.com;
    
    ssl_certificate /etc/nginx/ssl/signage.crt;
    ssl_certificate_key /etc/nginx/ssl/signage.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    
    # Add secure cookie flags to responses
    proxy_cookie_path / "/; Secure; HttpOnly; SameSite=Strict";
    
    location / {
        proxy_pass http://internal-dsspro-server:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
    }
}