First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-36925

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Arteco-Global	Arteco Web Client DVR/NVR	Unknown

References

Timeline

Published: Jan 6, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-369265.3SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification deta CVE-2020-369277.8DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attacker CVE-2020-369287.8Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. At CVE-2020-369297.8Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attack CVE-2020-36937.8u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdra CVE-2020-369307.8SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to poten CVE-2020-369316.4Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name in CVE-2020-369326.1SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject CVE-2020-369337.8HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unqu CVE-2020-369347.8Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to po CVE-2020-369357.8KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potenti CVE-2020-369367.8Magic Mouse 2 Utilities 2.20 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the

CVE-2020-36925: Critical severity, CVSS 9.8 | Vulnix