CVE-2020-37228: iDS6 DSSPro Digital Signage System - CAPTCHA Security Bypass

Overview

CVE-2020-37228 is a CAPTCHA security bypass in the iDS6 DSSPro Digital Signage System, version 6.2, as described by the CNA VulnCheck and cross-referenced by the CVE Record and NVD. The weakness is classified as CWE-307, improper restriction of excessive authentication attempts. Its practical effect is that the login CAPTCHA protection can be circumvented, which weakens defenses against automated guessing of credentials.

Impact

The record states that authentication can be bypassed in the affected login workflow.
The record states that CAPTCHA values can be obtained through the login endpoint and used in brute-force attempts against user accounts.
The CNA rates the issue critical, with CVSS v3.1 base score 9.8 and CVSS v4.0 score 9.3, reflecting network reachability and high confidentiality, integrity and availability impact.

Affected products and versions

Product named in the record: iDS6 DSSPro Digital Signage System, version 6.2.
The structured affected list in the record is empty, so the full set of affected versions is unknown.
The record lists no fixed versions. This does not confirm that no fix exists; the status of a fix is unknown.

Exploitation status

The KEV catalog entry is not listed in the record, so no active exploitation is confirmed by that source. No confirmed exploitation in the wild appears in the sources consulted. The references include an Exploit-DB entry, which indicates that public exploit material has been catalogued, but this does not by itself confirm attacks in the field. The EPSS probability in the record is 0.00429 (percentile 0.35364), dated 2026-10-13.

Remediation and mitigation

Check the vendor contact and vendor-related reference and the VulnCheck advisory for any update or guidance for version 6.2.
Restrict access to management and login interfaces to trusted networks, and avoid exposing them directly to the internet.
Enforce account lockout or rate limiting, and require strong, unique passwords, to reduce the value of any credential guessing.
If no vendor fix is confirmed, consider isolating the signage system and monitoring it closely until a fix or a supported replacement is available.

Detection guidance

Review authentication logs for unusually high volumes of failed login attempts against individual accounts or from single sources.
Monitor for repeated requests to the login endpoint that retrieve verification material before submissions.
Alert on successful logins that follow long sequences of failures, and review those accounts.

Limitations of the available information

The record does not list affected or fixed version ranges beyond the product description.
Its source status is shown as Deferred, and the EPSS date is later than the publication date, so the scoring context should be reviewed against current sources.
Vendor details are limited to a homepage reference, and no vendor advisory text is included in the record.
Whether the issue has been patched by the vendor is unknown from the sources consulted.

Frequently asked questions

What is CVE-2020-37228?

It is a CAPTCHA security bypass in the iDS6 DSSPro Digital Signage System 6.2, which the record says can enable authentication bypass and brute-force attempts against user accounts.

How severe is this vulnerability?

The CNA VulnCheck rates it critical, with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 score of 9.3.

Is this vulnerability being actively exploited?

The record does not list it in KEV, and no confirmed exploitation in the wild appears in the sources consulted. A public Exploit-DB reference is listed, but that does not confirm attacks.

Which versions are fixed?

The record lists no fixed versions, so the fix status is unknown. This does not mean no fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.