Lucene search

MitreCVE-2021-38142

HistorySep 07, 2021 - 6:15 p.m.

CVE-2021-38142

2021-09-0718:15:07

CWE-319

mitre

web.nvd.nist.gov

barco mirrorop

windows sender

cve-2021-38142

security vulnerability

rogue software upgrades

remote code execution

http

tls

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).

Affected configurations

Nvd

Node

barcomirrorop_windows_senderRange<2.5.3.65

VendorProductVersionCPE
barcomirrorop_windows_sender*cpe:2.3:a:barco:mirrorop_windows_sender:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
barco	mirrorop_windows_sender	*	cpe:2.3:a:barco:mirrorop_windows_sender::::::::

References

www.barco.com/en/support/cms

www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

Related for CVE-2021-38142