An improper access control vulnerability in the Yerootech iDS6 DSSPro Digital Signage System allows an authenticated attacker to escalate privileges and achieve full application takeover.

The application suffers from a privilege escalation flaw due to improper access control. Authenticated users can invoke JavaScript functions via the console or exploit insecure direct object references to manipulate user accounts, roles, and permissions.

Successful exploitation of this vulnerability permits an attacker with low-level authenticated access to escalate their privileges to administrative status. This results in a complete compromise of the digital signage management system, potentially allowing for unauthorized modification of content, system configuration changes, and the total takeover of the application infrastructure. Given the CVSS score of 8.8, this represents a high-severity risk to operational integrity and security.

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the management interface to trusted IP addresses only and disable any unnecessary user accounts.

Proactive Monitoring: Review web server access logs for anomalous POST requests to endpoints such as /Pages/user!addUser or /Pages/role!updatePermissions, which indicate attempts to manipulate user roles.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized attempts to execute administrative JavaScript functions or access sensitive action-based endpoints from non-administrative sessions.

Public Exploit Available: Yes, a published proof-of-concept and exploit details are available via Exploit-DB (EDB-ID: 48992) and Packet Storm.

Due to the availability of public exploit code and the critical impact of full application takeover, this vulnerability poses a significant risk to organizations utilizing the Yerootech iDS6 DSSPro system. Organizations must prioritize segmenting the management interface from public-facing networks and strictly auditing existing user accounts until a vendor-supplied update is available.