CVE-2020-28330

Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp of a Barco wePresent WiPG-1600W device.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

1.16% chance of exploitation in the next 30 days, 65th percentile

Published

2020-11-24

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://korelogic.com/Resources/Advisories/KL-001-2020-005.txt

References

• CVE Record
• NVD entry

Related

• CVE-2020-28329
• CVE-2020-28332
• CVE-2020-28328
• CVE-2020-28334
• CVE-2020-28282
• CVE-2020-28337