Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

EUVD-2020-20795

Malware in sbrugna...

EUVD-2020-20793

Malware in sbrugna...

EUVD-2020-20794

Malware in sbrugna...

EUVD-2020-20796

Malware in sbrugna...

EUVD-2021-22124

Malware in sbrugna...

EUVD-2020-20792

Malware in sbrugna...

EUVD-2025-21423

Malicious code in bioql PyPI...

CVE-2025-34103

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34103

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34103 WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34103 WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34103

CVE-2025-34103 describes an unauthenticated command injection in WePresent WiPG-1000 firmware prior to 2.2.3.0, caused by improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint where the Client parameter is not sanitized before a system call. This allows remote attackers to execut...

CVE-2025-34103: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

PT-2025-29545 · Wepresent · Wepresent Wipg-1000

Name of the Vulnerable Software and Affected Versions: WePresent WiPG-1000 versions prior to 2.2.3.0 Description: An unauthenticated command injection issue exists due to improper input handling in the /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a syst...

Barco WePresent WiPG-1000 security vulnerabilities

Barco WePresent WiPG-1000 is a wireless presentation server from Barco Belgium. A security vulnerability exists in the Barco WePresent WiPG-1000 prior to version 2.2.3.0, which stems from improper handling of /cgi-bin/rdfs.cgi endpoint inputs, which can lead to command injection...

CVE-2021-35482

An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution with user privileges of the local user on any device that tries to connect to a WePresent presentation system...

CVE-2020-28331

Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Versions: 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a...

CVE-2021-35482

An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution with user privileges of the local user on any device that tries to connect to a WePresent presentation system...