PT-2021-10089 · Barco · Barco Transform Ndn-210 Pro+3

Published 2021-01-07 · Updated 2021-01-13 · CVE-2020-17500

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro versions prior to 3.8

Description: The issue affects the web administration panel of the Barco TransForm NDN-210, which uses basic authentication over https. There is a command injection issue in the username and password fields of the logon prompt, resulting in unauthenticated remote code execution. The NDN-210 is part of the Barco TransForm N solution.

Recommendations: For Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro versions prior to 3.8, update to version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the web administration panel to minimize the risk of exploitation. Avoid using the username and password fields in the logon prompt until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-17500

Affected Products

Barco Transform Ndn-210 Lite

Barco Transform Ndn-210 Pro

Barco Transform Ndn-211 Lite

Barco Transform Ndn-211 Pro

References · 7

• https://barco.com/en/support/knowledge-base/kb11588 · Vendor Advisory
• https://barco.com/en/support/transform-n-management-server · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17500 · Vendor Advisory
• https://barco.com/en/support/cms · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17500 · Security Note
• https://t.me/cibsecurity/21794 · Telegram Post
• https://t.me/cvenotify/8298 · Telegram Post