CVE-2020-28330: barco wepresent_wipg-1600w_firmware Insufficiently Protected Credentials

Vulnerability summary

CVE-2020-28330 is a medium (CVSS 6.5) Insufficiently Protected Credentials vulnerability in barco wepresent_wipg-1600w_firmware. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 66.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-11-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp of a Barco wePresent WiPG-1600W device.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.