Vulnerability Description
Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules, ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Barco | Transform N | < 3.8 |
| Barco | Transform Ndn-210 Lite | - |
| Barco | Transform Ndn-210 Pro | - |
| Barco | Transform Ndn-211 Lite | - |
| Barco | Transform Ndn-211 Pro | - |
Related Weaknesses (CWE)
References
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/knowledge-base/kb11589Vendor Advisory
- https://www.barco.com/en/support/transform-n-management-serverProductVendor Advisory
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/knowledge-base/kb11589Vendor Advisory
- https://www.barco.com/en/support/transform-n-management-serverProductVendor Advisory
FAQ
What is CVE-2020-17502?
CVE-2020-17502 is a vulnerability with a CVSS score of 7.2 (HIGH). Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow ...
How severe is CVE-2020-17502?
CVE-2020-17502 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-17502?
Check the references section above for vendor advisories and patch information. Affected products include: Barco Transform N, Barco Transform Ndn-210 Lite, Barco Transform Ndn-210 Pro, Barco Transform Ndn-211 Lite, Barco Transform Ndn-211 Pro.