Vulnerability Description
Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET requests. Thus the "SEID" would be exposed in web proxy logs and browser history. An attacker that is able to capture the "SEID" and originate requests from the same IP address (via a NAT device or web proxy) would be able to access the user interface of the device without having to know the credentials.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Barco | Wepresent Wipg-1600W Firmware | 2.5.1.8 |
| Barco | Wepresent Wipg-1600W | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/160161/Barco-wePresent-Authentication-BypasThird Party AdvisoryVDB Entry
- https://korelogic.com/Resources/Advisories/KL-001-2020-006.txtThird Party Advisory
- http://packetstormsecurity.com/files/160161/Barco-wePresent-Authentication-BypasThird Party AdvisoryVDB Entry
- https://korelogic.com/Resources/Advisories/KL-001-2020-006.txtThird Party Advisory
FAQ
What is CVE-2020-28333?
CVE-2020-28333 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessi...
How severe is CVE-2020-28333?
CVE-2020-28333 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-28333?
Check the references section above for vendor advisories and patch information. Affected products include: Barco Wepresent Wipg-1600W Firmware, Barco Wepresent Wipg-1600W.