PT-2021-10091 · Barco · Barco Transform N

Published 2021-01-08 · Updated 2021-01-14 · CVE-2020-17503

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Barco TransForm N versions prior to 3.8

Description: The NDN-210 device has a web administration panel accessible over https, where a command injection issue allows authenticated users to perform remote code execution. The issue is located in the split card cmd.php file, specifically with the locking http parameter not being properly handled.

Recommendations: For versions prior to 3.8, update to TransForm N version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the split card cmd.php file or disabling the locking parameter in the http request to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-17503

Affected Products

Barco Transform N

References · 6

• https://osv.dev/vulnerability/CVE-2020-17503 · Vendor Advisory
• https://barco.com/en/support/transform-n-management-server · Vendor Advisory
• https://barco.com/en/support/cms · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17503 · Security Note
• https://barco.com/en/support/knowledge-base/kb11589 · Vendor Advisory
• https://t.me/cibsecurity/21841 · Telegram Post