Vulnerability Description
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Barco | Mirrorop Windows Sender | < 2.5.3.65 |
Related Weaknesses (CWE)
References
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=Release NotesVendor Advisory
- https://www.barco.com/en/support/cmsVendor Advisory
- https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=Release NotesVendor Advisory
FAQ
What is CVE-2021-38142?
CVE-2021-38142 is a vulnerability with a CVSS score of 8.8 (HIGH). Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries...
How severe is CVE-2021-38142?
CVE-2021-38142 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-38142?
Check the references section above for vendor advisories and patch information. Affected products include: Barco Mirrorop Windows Sender.