PT-2019-4694 · Barco+1 · Barco Clickshare Cs-100+4

Published 2019-12-16 · Updated 2020-08-24 · CVE-2019-18828

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Barco ClickShare CS-100 versions not specified Barco ClickShare CSE-200 versions not specified Barco ClickShare CSE-200+ versions not specified Barco ClickShare CSE-800 versions not specified Barco ClickShare Button R9861500D01 devices versions prior to 1.9.0

Description The issue is related to insufficient protection of registration data in the software of wireless systems. Exploitation of this issue may allow an attacker to elevate their privileges. The root account of the embedded Linux on the ClickShare Button uses a weak password, which is present for access via debug interfaces. These interfaces are not enabled by default on production devices.

Recommendations For Barco ClickShare CS-100, update to a version that addresses the issue, if available. For Barco ClickShare CSE-200, update to a version that addresses the issue, if available. For Barco ClickShare CSE-200+, update to a version that addresses the issue, if available. For Barco ClickShare CSE-800, update to a version that addresses the issue, if available. For Barco ClickShare Button R9861500D01 devices, update to version 1.9.0 or later. As a temporary workaround, consider disabling access to debug interfaces until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-521

Related Identifiers

BDU:2020-01070

CVE-2019-18828

Affected Products

Barco Clickshare Button R9861500D01

Barco Clickshare Cs-100

Barco Clickshare Cse-200

Barco Clickshare Cse-800

Linux

References · 13

• https://barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01070 · Security Note
• https://barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18828 · Security Note
• https://barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18828 · Vendor Advisory
• https://barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Vendor Advisory
• https://barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Note
• https://barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Note
• https://barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Note
• https://barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 · Note
• https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare · Note
• https://barco.com/en/clickshare/firmware-update · Note