CVE-2019-18830

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code execution on the ClickShare Button with the privileges of the user 'nobody'.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/	Third Party Advisory
https://www.barco.com/en/clickshare/firmware-update	Product
https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/	Third Party Advisory
https://www.barco.com/en/clickshare/firmware-update	Product
https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory
https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007	Product Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:barco:clickshare_cs-100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cs-100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:barco:clickshare_cse-200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-200:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:barco:clickshare_cse-200\+_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-200\+:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:barco:clickshare_cse-800_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-800:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:33

Type	Values Removed	Values Added
References	~~() https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/ - Third Party Advisory~~	() https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/ - Third Party Advisory
References	~~() https://www.barco.com/en/clickshare/firmware-update - Product~~	() https://www.barco.com/en/clickshare/firmware-update - Product
References	~~() https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory~~	() https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory
References	~~() https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory~~	() https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory
References	~~() https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory~~	() https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory
References	~~() https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory~~	() https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007 - Product, Vendor Advisory

Information

Published : 2019-12-16 17:15

Updated : 2024-11-21 04:33

NVD link : CVE-2019-18830

Mitre link : CVE-2019-18830

CVE.ORG link : CVE-2019-18830

JSON object : View

Products Affected

barco

clickshare_cse-800
clickshare_cse-200\+
clickshare_cs-100_firmware
clickshare_cse-800_firmware
clickshare_cs-100
clickshare_cse-200_firmware
clickshare_cse-200
clickshare_cse-200\+_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2019-18830", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-12-16T17:15:12.080", "references": [{"url": "https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/clickshare/firmware-update", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/clickshare/firmware-update", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/software/R33050095?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/software/R33050125?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code execution on the ClickShare Button with the privileges of the user 'nobody'."}, {"lang": "es", "value": "Los dispositivos Barco ClickShare Button R9861500D01 versiones anteriores a 1.9.0, permiten una inyecci\u00f3n de comandos de sistema operativo. El programa integrado \"dongle_bridge\" utilizado para exponer las funcionalidades del bot\u00f3n ClickShare a un host USB, es susceptible a vulnerabilidades de inyecci\u00f3n de comandos de sistema operativo. Estas vulnerabilidades podr\u00edan conllevar a una ejecuci\u00f3n de c\u00f3digo en el bot\u00f3n ClickShare con los privilegios del usuario \"nobody\"."}], "lastModified": "2024-11-21T04:33:39.907", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cs-100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7090BDE3-6955-4AE6-82FF-BB3AB9AD9620", "versionEndExcluding": "1.9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cs-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E0202C18-FEE5-4B0B-AEE6-793773D72393"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "022393D3-16B2-4ABB-865B-AB75D34A1D27", "versionEndExcluding": "1.9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7906FBC3-E8B5-4574-B13A-5DED4A60585B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-200\\+_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E84C6C03-91F5-4713-8B67-BA8044812F87", "versionEndExcluding": "1.9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-200\\+:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D18F4F1D-F306-4D4E-AA43-39D6E59013AD"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4542798B-C4CE-4DE1-83A1-7B24D33F940A", "versionEndExcluding": "1.9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9ABDD364-D1A4-4D96-8367-2CBDB53954D4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

9.8 /10