Injection Vulnerability in Barco ClickShare Products Allows OS-Level Command Execution
CVE-2024-53919

7.6HIGH

Key Information:

Vendor

Barco

Vendor
CVE Published:
10 December 2024

What is CVE-2024-53919?

An injection vulnerability exists in multiple Barco ClickShare models, including CX-30, CX-20, C-5, C-10, Bar Pro, and Core, which are running firmware earlier than version 2.21.1. This vulnerability permits attackers who are physically near the device or local administrators to exploit the webUI, thereby executing OS-level commands as the root user. This security flaw highlights the importance of keeping firmware updated to mitigate potential risks associated with unauthorized command execution.

References

https://cwe.mitre.org/data/definitions/78.html
https://www.barco.com/en/support/knowledge-base/15008-cli...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-53919 : Injection Vulnerability in Barco ClickShare Products Allows OS-Level Command Execution