barco Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/barco/ Sun, 26 Feb 2023 06:40:38 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png barco Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/barco/ 32 32 CVE-2020-28329 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28329/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28329/ Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.

The post CVE-2020-28329 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.

The post CVE-2020-28329 appeared first on CVE Vulnerability.

]]> CVE-2020-28330 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28330/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28330/ Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp of a Barco wePresent WiPG-1600W device.

The post CVE-2020-28330 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp of a Barco wePresent WiPG-1600W device.

The post CVE-2020-28330 appeared first on CVE Vulnerability.

]]> CVE-2020-28331 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28331/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28331/ Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a device configuration file variable to see if the SSH daemon […]

The post CVE-2020-28331 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a device configuration file variable to see if the SSH daemon should be started. The web interface does not provide a visible capability to alter this configuration file variable. However, a malicious actor can include this variable in a POST such that the SSH daemon will be started when the device boots.

The post CVE-2020-28331 appeared first on CVE Vulnerability.

]]> CVE-2020-28332 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28332/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28332/ Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modified/malicious images.

The post CVE-2020-28332 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modified/malicious images.

The post CVE-2020-28332 appeared first on CVE Vulnerability.

]]> CVE-2020-28333 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28333/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28333/ Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a “SEID” token that is appended to the end of URLs in GET requests. Thus the “SEID” would be exposed in web proxy logs and […]

The post CVE-2020-28333 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a “SEID” token that is appended to the end of URLs in GET requests. Thus the “SEID” would be exposed in web proxy logs and browser history. An attacker that is able to capture the “SEID” and originate requests from the same IP address (via a NAT device or web proxy) would be able to access the user interface of the device without having to know the credentials.

The post CVE-2020-28333 appeared first on CVE Vulnerability.

]]> CVE-2020-28334 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28334/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28334/ Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker […]

The post CVE-2020-28334 appeared first on CVE Vulnerability.

]]> Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell.

The post CVE-2020-28334 appeared first on CVE Vulnerability.

]]> CVE-2019-18833 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18833/ Sun, 26 Feb 2023 06:31:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18833/ Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An attacker who is able to perform a Man-in-the-Middle […]

The post CVE-2019-18833 appeared first on CVE Vulnerability.

]]> Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An attacker who is able to perform a Man-in-the-Middle attack between the TLS connection, is able to obtain the encryption key.

The post CVE-2019-18833 appeared first on CVE Vulnerability.

]]> CVE-2019-18824 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18824/ Sun, 26 Feb 2023 06:31:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18824/ Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of the mutable content on the UBIFS partition before being used.

The post CVE-2019-18824 appeared first on CVE Vulnerability.

]]> Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of the mutable content on the UBIFS partition before being used.

The post CVE-2019-18824 appeared first on CVE Vulnerability.

]]> CVE-2019-18825 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18825/ Sun, 26 Feb 2023 06:31:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18825/ Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption keys which are shared across all ClickShare Base Units of models CS-100 & CSE-200.

The post CVE-2019-18825 appeared first on CVE Vulnerability.

]]> Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption keys which are shared across all ClickShare Base Units of models CS-100 & CSE-200.

The post CVE-2019-18825 appeared first on CVE Vulnerability.

]]> CVE-2019-18826 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18826/ Sun, 26 Feb 2023 06:31:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18826/ Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate’s Chain of Trust. The embedded ‘dongle_bridge’ program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain.

The post CVE-2019-18826 appeared first on CVE Vulnerability.

]]> Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate’s Chain of Trust. The embedded ‘dongle_bridge’ program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain.

The post CVE-2019-18826 appeared first on CVE Vulnerability.

]]>