CVE-2020-28329

Published: Nov 24, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.

Affected (4)

Products: Barco: Wepresent Wipg 1600w Firmware

Barco

1 product

Wepresent Wipg 1600w Firmware

Configuration A

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barco Wepresent Wipg 1600w Firmware	Version 2.4.1.19
Barco Wepresent Wipg 1600w Firmware	Version 2.5.0.24
Barco Wepresent Wipg 1600w Firmware	Version 2.5.0.25
Barco Wepresent Wipg 1600w Firmware	Version 2.5.1.8

Running on/with	Platform Versions
Barco Wepresent Wipg 1600w	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.