CVE-2020-28329

Опубликовано: 24 нояб. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.

Ссылки

https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt
Exploit
Third Party Advisory
https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:2.4.1.19:*:*:*:*:*:*:*

cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:2.5.0.24:*:*:*:*:*:*:*

cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:2.5.0.25:*:*:*:*:*:*:*

cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:2.5.1.8:*:*:*:*:*:*:*

cpe:2.3:h:barco:wepresent_wipg-1600w:-:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00706

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-r54x-g9vf-56fv

github

больше 3 лет назад