cbcvebase.
CVE-2022-26233
published 2022-04-03

CVE-2022-26233: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive…

PriorityP261high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
15.03%
96.3th percentile
Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring.

Affected

1 ranges
VendorProductVersion rangeFixed in
barcocontrol_room_management_suite<= 2.9—

Detection & IOCsextracted from sources · hover to see the quote

path/..\..\..\..\..\..\..\..\..\..\windows\win.ini↗
commandGET /..\..↗
  • →Detect directory traversal attempts against Barco Control Room Management Suite by matching HTTP requests where the URI begins with the 'GET /..\..' pattern (backslash-based traversal sequence). ↗
  • →Confirm exploitation by checking HTTP response body for all three strings: 'bit app support', 'fonts', and 'extensions' — indicative of a successfully read windows\win.ini file.
  • →Flag HTTP GET requests containing mixed forward-slash and backslash traversal sequences (e.g., /..\..\..\) targeting the Barco Control Room Management Suite web interface.
  • ·The traversal payload uses backslashes ('\') rather than forward slashes ('/'), which may bypass naive path-normalization defenses and requires WAF/IDS rules to account for backslash-based traversal sequences specifically. ↗
  • ·The Nuclei template sets 'unsafe: true', meaning the raw HTTP request is sent without standard library normalization — detection tools that rely on normalized URLs may miss this attack in transit.
  • ·Vulnerability affects all versions up to and including 2.9 Build 0275; no authentication is required (PR:N, UI:N), making it remotely and trivially exploitable.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.