CVE-2020-28333 describes an authentication bypass vulnerability in Barco wePresent WiPG-1600W devices running firmware version 2.5.1.8. The web interface uses a "SEID" token in URLs instead of secure session cookies, making it susceptible to capture. An attacker obtaining this token can gain unauthorized access to the device's user interface from the same IP address. This vulnerability is rated Critical with a CVSS score of 9.8, indicating a severe risk. It is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Despite this, the CVE has garnered significant community discussion, with 10 mentions, suggesting awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.5.1.8CPE matchmatch criteria | cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:2.5.1.8:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.