CVE-2019-18826 - OpenCVE

Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Barco	Clickshare Cse-200\+ Firmware Clickshare Cse-800 Firmware Clickshare Cs-100 Firmware Clickshare Cse-200\+ Clickshare Cse-800 Clickshare Cse-200 Firmware Clickshare Cs-100 Clickshare Cse-200

Configuration 1 [-]

AND

cpe:2.3:o:barco:clickshare_cs-100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cs-100:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:barco:clickshare_cse-200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-200:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:barco:clickshare_cse-200\+_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-200\+:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:barco:clickshare_cse-800_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:barco:clickshare_cse-800:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.barco.com/en/clickshare/firmware-update	Product Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2019-12-16T16:13:09

Updated: 2019-12-16T16:13:09

Reserved: 2019-11-07T00:00:00

Link: CVE-2019-18826

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-12-16T17:15:11.877

Modified: 2019-12-27T01:14:58.913

Link: CVE-2019-18826

JSON object: View

Redhat Information

No data.

CWE

CWE-295

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cs-100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7090BDE3-6955-4AE6-82FF-BB3AB9AD9620", "versionEndExcluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cs-100:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0202C18-FEE5-4B0B-AEE6-793773D72393", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "022393D3-16B2-4ABB-865B-AB75D34A1D27", "versionEndExcluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-200:-:*:*:*:*:*:*:*", "matchCriteriaId": "7906FBC3-E8B5-4574-B13A-5DED4A60585B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-200\\+_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E84C6C03-91F5-4713-8B67-BA8044812F87", "versionEndExcluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-200\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "D18F4F1D-F306-4D4E-AA43-39D6E59013AD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_cse-800_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4542798B-C4CE-4DE1-83A1-7B24D33F940A", "versionEndExcluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_cse-800:-:*:*:*:*:*:*:*", "matchCriteriaId": "9ABDD364-D1A4-4D96-8367-2CBDB53954D4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain."}, {"lang": "es", "value": "Los dispositivos Barco ClickShare Button R9861500D01 versiones anteriores a 1.9.0, presentan Seguimiento Inapropiado de una Cadena de Confianza del Certificado. El programa integrado \"dongle_bridge\" utilizado para exponer las funcionalidades del ClickShare Button en un host USB, no comprueba apropiadamente la cadena de certificados completa."}], "id": "CVE-2019-18826", "lastModified": "2019-12-27T01:14:58.913", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-16T17:15:11.877", "references": [{"source": "cve@mitre.org", "tags": ["Product", "Vendor Advisory"], "url": "https://www.barco.com/en/clickshare/firmware-update"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}