Yerootech vulnerabilities
Published CVEs affecting Yerootech products: 3 record(s), with severity, exploitation and fixes.
CVE-2020-37228
Critical · 9.8
CWE-307 May 16, 2026
iDS6 DSSPro Digital Signage System - CAPTCHA Security Bypass
iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks against user accounts.
CVE-2020-36920
High · 8.8
CWE-863 Jan 6, 2026
iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
CVE-2020-36918
Medium · 4.3
CWE-352 Jan 6, 2026
iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft malicious web pages to trick logged-in administrators into adding unauthorized users by exploiting the lack of CSRF protections.