CVE-2020-28333

Vulnerability

The Barco wePresent WiPG-1600W (firmware version 2.5.1.8) uses a "SEID" token appended to URLs in GET requests (and in POST bodies) to track authenticated sessions, rather than using session cookies. This exposes the SEID in web proxy logs, browser history, and other network traces. The web interface on the device does not enforce proper session management, allowing an attacker who captures a valid SEID to access protected pages and make configuration changes without authentication [1][2].

Exploitation

An attacker must capture a valid SEID token (e.g., from a proxy log, browser history, or man-in-the-middle position) and originate requests from the same IP address as the original session (e.g., via a NAT device or web proxy spoofing). With the SEID, the attacker can directly access URLs (e.g., https://device/cgi-bin/web_index.cgi?lang=en&src=AwSystem.html&SEID) or make POST requests with the SEID in the body to perform administrative actions [1].

Impact

Successful exploitation grants the attacker full access to the device's web interface without knowing the credentials. This includes the ability to view and modify configuration settings, potentially compromising the device's operation, network segmentation, or leading to further attacks against connected systems. The attacker does not gain complete system control beyond the web interface but can alter device behavior [1].

Mitigation

As of the advisory publication date (2020-11-20), no patch or firmware update has been released by Barco to address this issue. The vendor has not responded to disclosures, and no workaround is provided in the available references. Users are advised to restrict network access to the device, monitor for unusual SEID usage, and consider network segmentation or proxy blocking where feasible [1][2].