Medium severity · published Dec 16, 2019
CVE-2019-18827
On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution
5.9
CVSS
1.4%
EPSS
No
On KEV
Description
On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before handing control over to embedded firmware.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Clickshare Cs-100 Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-200 Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-200+ Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-800 Firmware · Barco
before 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18827
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18827
Third Party Advisory
https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
Product
https://www.barco.com/en/clickshare/firmware-update
Product
https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
More from Clickshare Cs-100 Firmware
9.8
CVE-2019-18830
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection
9.8
CVE-2019-18826
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust
7.5
CVE-2018-10943
An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3
6.8
CVE-2019-18828
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials
5.3
CVE-2019-18831
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure