CVE-2020-28329
published 2020-11-24CVE-2020-28329: Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.54%
71.8th percentile
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| barco | wepresent_wipg-1600w_firmware | — | — |
| barco | wepresent_wipg-1600w_firmware | — | — |
| barco | wepresent_wipg-1600w_firmware | — | — |
| barco | wepresent_wipg-1600w_firmware | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f2rm-99fw-5555: Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2020-28330 [CRITICAL] CWE-522 GHSA-f2rm-99fw-5555: Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials
Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp of a Barco wePresent WiPG-1600W device.
GHSA
GHSA-ww7r-3h84-p2r6: Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2)
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2020-28334 [CRITICAL] CWE-798 GHSA-ww7r-3h84-p2r6: Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2)
Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell.
GHSA
GHSA-r54x-g9vf-56fv: Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image
ghsa_unreviewed·2022-05-24
CVE-2020-28329 [CRITICAL] CWE-798 GHSA-r54x-g9vf-56fv: Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-11-24
Published