SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via Criação de Usuário

The impact of this XSRF vulnerability is significant. An attacker can craft a malicious web page that, when visited by a logged-in user with sufficient privileges, automatically submits a form to create a new administrative user account. This bypasses standard authentication and authorization controls, effectively granting the attacker full system privileges. Successful exploitation could lead to unauthorized access to sensitive data, modification of system configurations, and even complete compromise of the digital signage deployment. The attacker could then leverage this administrative access to deploy malicious content, disrupt operations, or exfiltrate confidential information.

Organizations deploying SpinetiX Fusion Digital Signage in environments where users have administrative privileges and browse untrusted websites are at risk. Shared hosting environments where multiple users share the same instance of the digital signage software are particularly vulnerable, as an attacker could potentially compromise the entire deployment through a single user's account.

1. 2025-12-10Disclosure

   disclosure

1. Reservado2025-12-09
2. Publicada2025-12-10
3. Modificada2025-12-11
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2020-36886 is to upgrade SpinetiX Fusion Digital Signage to version 8.2.27 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing stricter input validation on administrative account creation forms to mitigate the risk of unauthorized account creation. Web Application Firewalls (WAFs) configured to detect and block XSRF attacks can also provide an additional layer of protection. Regularly review user accounts and permissions to identify and remove any suspicious or unauthorized accounts.