CVSS: 10.0EPSS: 2%CPEs: 5EXPL: 2CVE-2020-28334 – Barco wePresent Global Hardcoded Root SSH Password
https://notcve.org/view.php?id=CVE-2020-28334
Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell. Los dispositivos Barco wePresent WiPG-1600W utilizan Credenciales Embebidas (problema 2 de 2). • http://packetstormsecurity.com/files/160163/Barco-wePresent-Global-Hardcoded-Root-SSH-Password.html https://korelogic.com/Resources/Advisories/KL-001-2020-008.txt • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2020-28329 – Barco wePresent Admin Credential Exposure
https://notcve.org/view.php?id=CVE-2020-28329
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. El firmware Barco wePresent WiPG-1600W incluye una cuenta y contraseña de API embebidas que se pueden detectar al inspeccionar la imagen del firmware. Un actor malicioso podría usar esta contraseña para acceder a funciones administrativas autenticadas en la API. • https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt • CWE-798: Use of Hard-coded Credentials •