Eibiz i-Media Server Digital Signage 3.8.0 Remote Privilege Escalation / Account Takeover

Posted on 22 August 2020

Eibiz i-Media Server Digital Signage version 3.8.0 suffers from an unauthenticated remote privilege escalation and account takeover vulnerability that can be triggered by directly calling the updateUser object (part of ActionScript object graphs), effectively elevating to an administrative role or taking over an existing account by modifying the settings.