PT-2021-10090 · Barco · Barco Transform N

Published 2021-01-08 · Updated 2021-01-13 · CVE-2020-17502

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Barco TransForm N versions prior to 3.8

Description: The issue allows authenticated users of the administration panel to perform authenticated remote code execution due to a command injection problem. This problem exists in the split card cmd.php file, where the HTTP parameters xmodules, ymodules, and savelocking are not properly handled. The web administration panel is made available over HTTPS.

Recommendations: For versions prior to 3.8, update to version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the split card cmd.php file and the HTTP parameters xmodules, ymodules, and savelocking to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-17502

Affected Products

Barco Transform N

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-17502 · Security Note
• https://barco.com/en/support/transform-n-management-server · Vendor Advisory
• https://barco.com/en/support/cms · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17502 · Vendor Advisory
• https://barco.com/en/support/knowledge-base/kb11589 · Vendor Advisory
• https://t.me/cibsecurity/21837 · Telegram Post