CVE-2021-38142: High severity Barco MirrorOp Windows Sender vulnerability
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Barco MirrorOp Windows Senderto a version that resolves this vulnerability.Fixed in 2.5.3.65 - Compensating control
Restrict network access so that Windows Sender update traffic cannot be intercepted or redirected over cleartext HTTP on the local network (e.g., allow update endpoint access only from trusted hosts/segments).
Event History
Frequently Asked Questions
What is CVE-2021-38142?
CVE-2021-38142 is a vulnerability in Barco MirrorOp Windows Sender before 2.5.3.65 that allows rogue software upgrades and can lead to remote code execution.
How does CVE-2021-38142 affect Barco MirrorOp Windows Sender?
CVE-2021-38142 affects Barco MirrorOp Windows Sender before version 2.5.3.65 by allowing rogue software upgrades and enabling remote code execution.
What is the severity of CVE-2021-38142?
CVE-2021-38142 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2021-38142?
An attacker on the local network can exploit CVE-2021-38142 by performing rogue software upgrades, leading to remote code execution on any computer attempting to update Barco MirrorOp Windows Sender.
How can I fix CVE-2021-38142?
To fix CVE-2021-38142, it is recommended to update to version 2.5.3.65 or later of Barco MirrorOp Windows Sender, which addresses the vulnerability.