PT-2021-21962 · Barco · Barco Mirrorop Windows Sender

Published 2021-09-07 · Updated 2022-07-12 · CVE-2021-38142

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Barco MirrorOp Windows Sender versions prior to 2.5.3.65

Description: The issue allows rogue software upgrades due to the use of cleartext HTTP, which is not secured with TLS. An attacker on the local network can achieve remote code execution on any computer that tries to update the software.

Recommendations: For versions prior to 2.5.3.65, update to version 2.5.3.65 or later to resolve the issue. As a temporary workaround, consider restricting access to the upgrade mechanism to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-38142

Affected Products

Barco Mirrorop Windows Sender

References · 5

• https://barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38142 · Vendor Advisory
• https://barco.com/en/support/cms · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38142 · Security Note
• https://t.me/cibsecurity/28378 · Telegram Post