CVE-2020-36896

CVE-2020-36896 describes a cleartext credentials vulnerability in QiHang Media Web Digital Signage 3.0.9, allowing unauthenticated attackers to retrieve hardcoded administrative login information from an unprotected XML file at /xml/User/User.xml. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, as it enables direct authentication bypass. Despite its high severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.