What is CVE-2020-36897?

CVE-2020-36897 is a critical-severity vulnerability in Howfor Qihang Media Web Digital Signage, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2025-12-10.

How severe is CVE-2020-36897?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Arbitrary file upload in Howfor Qihang Media Web Digital Signage

CVE-2020-36897

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

Vulnerability class: Unrestricted File Upload

EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Howfor Qihang_media_web_digital_signage — versions 3.0.9
Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Web Digital Signage — versions 3.0.9

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

disclosure@vulncheck.com (Exploit, VDB Entry, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Exploit, vendor-advisory, Third Party Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2020-36897?: CVE-2020-36897 is a critical-severity vulnerability in Howfor Qihang Media Web Digital Signage, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2025-12-10.
How severe is CVE-2020-36897?: Critical severity. CVSS v3 base score is 9.8 out of 10.