Vulnerability Details CVE-2019-18830
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code execution on the ClickShare Button with the privileges of the user 'nobody'.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.033
EPSS Ranking 86.6%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
- https://www.barco.com/en/clickshare/firmware-update
- https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
- https://www.barco.com/en/clickshare/firmware-update
- https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
- https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
Products affected by CVE-2019-18830
-
cpe:2.3:h:barco:clickshare_cs-100:-
-
cpe:2.3:h:barco:clickshare_cse-200+:-
-
cpe:2.3:h:barco:clickshare_cse-200:-
-
cpe:2.3:h:barco:clickshare_cse-800:-
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:-
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.1.0.8
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.2.0.1
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.2.1.1
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.2.2.3
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.3.0.29
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.3.1.3
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.3.4.8
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.4.0.105
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.4.2.12
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.5.0.12
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.5.1.2
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.5.2.3
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.6.0.3
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.6.1.2
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.7.0.22
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.7.1.1
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.8.0.6
-
cpe:2.3:o:barco:clickshare_cs-100_firmware:1.8.1.2
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:-
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:1.6.4.4
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:1.7.0.22
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:1.7.1.1
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:1.8.0.6
-
cpe:2.3:o:barco:clickshare_cse-200+_firmware:1.8.1.2
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:-
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:01.03.01.05
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.1.0.8
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.2.0.1
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.2.1.1
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.2.2.3
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.3.0.29
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.3.1.3
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.3.1.5
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.3.4.8
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.4.0.105
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.4.2.12
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.5.0.12
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.5.1.2
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.5.2.3
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.6.0.3
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.6.1.2
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.7.0.22
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.7.1.1
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.8.0.6
-
cpe:2.3:o:barco:clickshare_cse-200_firmware:1.8.1.2
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:-
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.1.0.99
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.2.0.47
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.2.1.6
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.5.0.12
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.5.1.2
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.5.2.3
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.6.1.2
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.6.2.7
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.6.4.4
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.7.0.22
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.7.1.1
-
cpe:2.3:o:barco:clickshare_cse-800_firmware:1.8.2.2