CVE-2020-28333: Infoleak
First published: Tue Nov 24 2020(Updated: )
Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET requests. Thus the "SEID" would be exposed in web proxy logs and browser history. An attacker that is able to capture the "SEID" and originate requests from the same IP address (via a NAT device or web proxy) would be able to access the user interface of the device without having to know the credentials.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Barco wePresent WiPG-1600W firmware | =2.5.1.8 | |
| Barco wePresent WiPG-1600W |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-28333.
What is the severity of CVE-2020-28333?
The severity of CVE-2020-28333 is critical with a score of 9.8.
Which devices are affected by CVE-2020-28333?
Barco wePresent WiPG-1600W devices with firmware version 2.5.1.8 are affected by CVE-2020-28333.
How does CVE-2020-28333 impact affected devices?
CVE-2020-28333 allows attackers to bypass authentication on Barco wePresent WiPG-1600W devices, potentially leading to unauthorized access.
Is there a fix available for CVE-2020-28333?
At the moment, there is no known fix or official patch available for CVE-2020-28333. It is recommended to follow the vendor's advisory and apply any recommended mitigations.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/references
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/barco
- canonical/barco wepresent wipg-1600w firmware
- version/barco wepresent wipg-1600w firmware/2.5.1.8
- canonical/barco wepresent wipg-1600w