Improper Access Control in Barco wePresent WiPG-1600W Devices

CVE-2020-28331

What is CVE-2020-28331?

The Barco wePresent WiPG-1600W device contains an improper access control vulnerability due to an SSH daemon included in its firmware. Although typically disabled by default and not initiated during system boot, a malicious actor can exploit this vulnerability by manipulating the device's configuration through a crafted POST request. This action can enable the SSH daemon during the device's startup, potentially allowing unauthorized access and control over the affected devices. Organizations using this product should assess their device configuration practices and apply any necessary security patches.

References