CVE-2020-28329

Vulnerability

Barco wePresent WiPG-1600W firmware versions 2.5.1.8, 2.5.0.25, 2.5.0.24, and 2.4.1.19 contain a hardcoded API account and password stored in clear text in /etc/lighthttp/admin and in hashed form in /etc/lighttpd/lighttpd.user. This credential pair is used to authenticate against an API service listening on TCP port 4001, which exposes administrative functions. The credentials are discoverable by anyone who can inspect the firmware image [1].

Exploitation

An attacker with network access to the affected device can connect to the API service on port 4001/tcp and authenticate using the hardcoded credentials, which are publicly documented in the firmware image. No prior authentication or user interaction is required [1].

Impact

Successful authentication grants the attacker administrative-level access to the API. This can lead to full compromise of the device, including the ability to modify device configuration, execute arbitrary commands, and potentially pivot to other network resources. The impact is a loss of confidentiality, integrity, and availability [1].

Mitigation

Barco has released firmware version 2.5.3.12 which remediates this vulnerability. Users should update to this version or later from the vendor's support site. No workarounds are documented for unpatched devices [1].