Description
iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Guangzhou Yeroo Tech | iDS6 DSSPro Digital Signage System | V6.2 B2014.12.12.1220, V5.6 B2017.07.12.1757, V4.3 | — |
References
- Zero Science Lab Disclosure (ZSL-2020-5605) third-party-advisory
- Packet Storm Security Exploit Entry exploit
- IBM X-Force Vulnerability Exchange vdb-entry
- CXSecurity Vulnerability Database Entry third-party-advisory
- Archived Yeroo Tech Vendor Homepage product
- VulnCheck Advisory: iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie third-party-advisory