Vulnerability Description
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "locking" is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Barco | Transform N | < 3.8 |
| Barco | Transform Ndn-210 Lite | - |
| Barco | Transform Ndn-210 Pro | - |
| Barco | Transform Ndn-211 Lite | - |
| Barco | Transform Ndn-211 Pro | - |
Related Weaknesses (CWE)
References
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/knowledge-base/kb11589Vendor Advisory
- https://www.barco.com/en/support/transform-n-management-serverProductVendor Advisory
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/knowledge-base/kb11589Vendor Advisory
- https://www.barco.com/en/support/transform-n-management-serverProductVendor Advisory
FAQ
What is CVE-2020-17503?
CVE-2020-17503 is a vulnerability with a CVSS score of 7.2 (HIGH). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticat...
How severe is CVE-2020-17503?
CVE-2020-17503 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-17503?
Check the references section above for vendor advisories and patch information. Affected products include: Barco Transform N, Barco Transform Ndn-210 Lite, Barco Transform Ndn-210 Pro, Barco Transform Ndn-211 Lite, Barco Transform Ndn-211 Pro.