CVE-2020-28329

Related Files

Barco wePresent Admin Credential Exposure

Posted Nov 20, 2020

Authored by Jim Becher | Site korelogic.com

An attacker armed with hardcoded API credentials from KL-001-2020-004 (CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp for Barco wePresent WiPG-1600W version 2.5.1.8.

tags | exploit, web, tcp

advisories | CVE-2020-28329, CVE-2020-28330

SHA-256 | d17ea5576bc764da9307b56d3e500fe6c4d6a46a6d607ac07eeebd256034d86c

Download | Favorite | View

Barco wePresent Hardcoded API Credentials

Posted Nov 20, 2020

Authored by Jim Becher | Site korelogic.com

Barco wePresent device firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Versions affected include 2.5.1.8, 2.5.0.25, 2.5.0.24, and 2.4.1.19.

tags | exploit

advisories | CVE-2020-28329

SHA-256 | 22801e1943167d9cae8f39b9e75645ceb62540439a7d2d3cf58ea0fee603d235

Download | Favorite | View