CVE-2020-28331
First published: Tue Nov 24 2020(Updated: )
Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a device configuration file variable to see if the SSH daemon should be started. The web interface does not provide a visible capability to alter this configuration file variable. However, a malicious actor can include this variable in a POST such that the SSH daemon will be started when the device boots.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Barco wePresent WiPG-1600W firmware | =2.5.1.8 | |
| Barco wePresent WiPG-1600W |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-28331.
What is the severity of CVE-2020-28331?
The severity of CVE-2020-28331 is high with a CVSS score of 7.5.
Which version(s) of the Barco wePresent WiPG-1600W firmware are affected?
The Barco wePresent WiPG-1600W firmware version 2.5.1.8 is affected.
What is the issue with the Barco wePresent WiPG-1600W devices?
Barco wePresent WiPG-1600W devices have an improper access control vulnerability.
Is the SSH daemon enabled by default on the Barco wePresent WiPG-1600W devices?
No, the SSH daemon is disabled by default and does not start at system boot.
Are there any references for further information?
Yes, you can refer to the following links for more information: [Packet Storm Security](http://packetstormsecurity.com/files/160162/Barco-wePresent-Undocumented-SSH-Interface.html) and [KoreLogic Advisory](https://korelogic.com/Resources/Advisories/KL-001-2020-007.txt).
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/barco
- canonical/barco wepresent wipg-1600w firmware
- version/barco wepresent wipg-1600w firmware/2.5.1.8
- canonical/barco wepresent wipg-1600w