CVE-2020-36892 is a critical (CVSS 9.8) missing authentication flaw in Eibiz i-Media Server Digital Signage 3.8.0 and earlier. The /messagebroker/amf endpoint lets an unauthenticated user change account roles through the updateUser object and take over accounts. No fixed version is confirmed.
What's affected
Eibiz i-Media Server Digital Signage version 3.8.0 and earlier, per VulnCheck. The record names version 3.8.0.
The record says the updateUser object, reached through the /messagebroker/amf endpoint, allows attackers to modify user roles and take over accounts without authentication.
I could not confirm a fixed release from the sources available. The vendor's site is linked in the record. Ask the vendor directly, and treat the product as unpatched until you hear otherwise.
How to check if you're exposed
Find the version of the signage server in its admin interface. 3.8.0 or earlier is in scope.
Then check whether the server is reachable from outside the network that needs it. Digital signage servers are often exposed so that remote displays can reach them:
nmap -sV -p 80,8080,443 <server-address>
Review the user list in the product for unexpected administrator accounts, or users whose role changed. Check logs for requests to the AMF endpoint path from unrecognised addresses.
What to do now
- Find all i-Media Server installs and their versions.
- Contact the vendor about a fix and track the answer.
- Limit access to the server to the signage players and the administrator addresses that need it.
- Review accounts and roles, remove anything unexpected and reset administrator passwords.
- Keep signage servers off networks that hold business data.
Why it matters
The record classes this as CWE-306 (Missing Authentication for Critical Function). Changing a user's role is one of the most sensitive actions an application offers, and the endpoint that performs it does not check who is asking. Any visitor can promote an account.
This is a design error, not a coding slip in a parser. Each sensitive operation needs an authentication check and an authorisation check on the server side, regardless of what the user interface shows.
Digital signage is easy to overlook as a security concern, yet the servers run on ordinary hosts and show content to the public. Compromised content on a public display is a reputational problem as well as a technical one.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Is there a fixed i-Media Server version?
I could not confirm one. The record names 3.8.0 as affected. Ask the vendor.
Does the attacker need an account?
No. The record describes the flaw as unauthenticated.
Sources
Last reviewed: 19 October 2026.
