High severity · published Jan 6, 2026
CVE-2020-36922
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information Disclosure
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Sony BRAVIA Digital Signage · Pro-Bravia
through 1.7.8 · source: vendor
BS
Bravia Signage · Sony
through 1.7.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36922
Third Party Advisory
https://cxsecurity.com/issue/WLB-2020120028
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/192606
Third Party Advisory
https://packetstorm.news/files/id/160343
Product
https://pro-bravia.sony.net
Product
https://pro-bravia.sony.net/resources/software/bravia-signage/
Product
https://pro.sony/ue_US/products/display-software
More from Sony BRAVIA Digital Signage
6.1
CVE-2020-36924
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion