CVE-2020-28332

Vulnerability

The Barco wePresent WiPG-1600W device firmware does not perform cryptographic verification of digitally signed firmware updates. The firmware update process is thus vulnerable to processing and installing modified or malicious images. The affected firmware versions are 2.5.1.8, 2.5.0.25, 2.5.0.24, and 2.4.1.19. The firmware is comprised of a 512-byte header, a cramfs filesystem, a uBoot image, and a tar.gz archive containing configuration files such as /etc/shadow. While the device computes a checksum to validate firmware integrity, this is not a cryptographic signature and can be bypassed by modifying the header's checksum field [1][2].

Exploitation

An attacker with network access to the device and the ability to serve a crafted firmware image (e.g., via a man-in-the-middle position or by hosting a malicious update server) can bypass the integrity check. The attacker must construct a modified firmware image that includes a correct checksum in the header. The technical details include: using binwalk to unpack the original firmware, modifying the target files (e.g., the cramfs filesystem or the tar.gz archive), recalculating the checksum stored in the header, and then repackaging the image. The device will accept the modified image because it only verifies the checksum, not a digital signature [1].

Impact

Successful exploitation allows the attacker to install arbitrary firmware on the device, resulting in full compromise of the device. The attacker can achieve arbitrary code execution with root privileges, enabling persistent backdoor access, data exfiltration, or use of the device as a pivot point within the network. The integrity and authenticity of the device's software are completely undermined [1][2].

Mitigation

Barco has not released a security advisory or patched firmware version for this vulnerability as of the publication date (2020-11-24). Users should monitor the vendor's official support channels for an update that includes cryptographic signature verification of firmware images. Until a fix is available, administrators should restrict network access to the device, apply strict firewall rules to prevent unauthorized firmware download attempts, and ensure the device is not exposed to untrusted networks. The CVE is not listed on the CISA Known Exploited Vulnerabilities catalog [1][2].