Medium severity · published Dec 16, 2019
CVE-2019-18828
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account (present for access via debug interfaces, which are by default not enabled on production devices) of the embedded Linux on the ClickShare Button is using a weak password.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Clickshare Cs-100 Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-200 Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-200+ Firmware · Barco
before 1.9.0 · source: NVD
CC
Clickshare Cse-800 Firmware · Barco
before 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18828
Third Party Advisory
https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
Product
https://www.barco.com/en/clickshare/firmware-update
Product
https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Product
https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
More from Clickshare Cs-100 Firmware
9.8
CVE-2019-18830
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection
9.8
CVE-2019-18826
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust
7.5
CVE-2018-10943
An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3
5.9
CVE-2019-18827
On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution
5.3
CVE-2019-18831
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure