Sign-up

ID

VAR-201701-0401


CVE

CVE-2016-3149


TITLE

Barco ClickShare CSC-1 and CSM-1 Vulnerability to execute arbitrary code in device firmware

Trust: 0.8

sources: JVNDB: JVNDB-2016-006879

DESCRIPTION

Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code via unspecified vectors. Barco ClickShare is prone to a remote code-execution vulnerability. Failed exploit attempts may cause a denial-of-service condition. Versions prior to Barco ClickShare 01.09.03 and 01.06.02 are vulnerable. Barco ClickShare CSC-1 etc. are wireless presentation systems of Belgium Barco (Barco). CVE-2016-3150 - Cross-site Scripting in Barco ClickShare CSC-1, CSM-1 and CSE-200 Affected versions: all versions prior to v01.09.03 (CSC-1), v01.06.02 (CSM-1) and v01.03.02 (CSE-200) A Cross-Site Scripting vulnerability exists within Barco ClickShare's CSC-1 base unit's wallpaper.php due to invalid input and output sanitisation. A Path Traversal vulnerability exists within Barco ClickShare's wallpaper parsing functionality, which leads to disclosure of the /etc/shadow file on the file system. CVE-2016-3152 - /etc/shadow file disclosure in the CSC-1 firmware update Affected versions: all versions prior to v01.09.03 (CSC-1) It is possible to download and extract the firmware image of the CSC-1 and obtain the root password. The vendor has acknowledged and patched the aforementioned issues. It is recommended to download and apply the most recent firmware update for your appliance. References: http://www.barco.com/en/mybarco/mysupport/documentation/software/software-detail?nr=R33050020&rev=001002000009 http://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050037&rev=001001000113 https://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050070&rev=001001000008 -- Regards, Vincent Ruijter Ethical Hacker Chief Information Security Office KPN B.V

Trust: 2.16

sources: NVD: CVE-2016-3149 // JVNDB: JVNDB-2016-006879 // BID: 94323 // VULHUB: VHN-91968 // VULMON: CVE-2016-3149 // PACKETSTORM: 139713

AFFECTED PRODUCTS

vendor:barcomodel:clickshare csc-1scope:lteversion:01.09.02.03

Trust: 1.0

vendor:barcomodel:clickshare csm-1scope:lteversion:01.06.01.04

Trust: 1.0

vendor:barcomodel:clickshare csc-1scope: - version: -

Trust: 0.8

vendor:barcomodel:clickshare csc-1scope:ltversion:01.09.03

Trust: 0.8

vendor:barcomodel:clickshare csm-1scope: - version: -

Trust: 0.8

vendor:barcomodel:clickshare csm-1scope:ltversion:01.06.02

Trust: 0.8

vendor:barcomodel:clickshare csm-1scope:eqversion:01.06.01.04

Trust: 0.6

vendor:barcomodel:clickshare csc-1scope:eqversion:01.09.02.03

Trust: 0.6

vendor:barcomodel:clicksharescope:eqversion:1.9.2

Trust: 0.3

vendor:barcomodel:clicksharescope:eqversion:1.6.1

Trust: 0.3

vendor:barcomodel:clicksharescope:neversion:1.9.3

Trust: 0.3

vendor:barcomodel:clicksharescope:neversion:1.6.2

Trust: 0.3

sources: BID: 94323 // JVNDB: JVNDB-2016-006879 // CNNVD: CNNVD-201611-540 // NVD: CVE-2016-3149

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-3149
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-3149
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201611-540
value: CRITICAL

Trust: 0.6

VULHUB: VHN-91968
value: HIGH

Trust: 0.1

VULMON: CVE-2016-3149
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-3149
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-91968
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-3149
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-91968 // VULMON: CVE-2016-3149 // JVNDB: JVNDB-2016-006879 // CNNVD: CNNVD-201611-540 // NVD: CVE-2016-3149

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2016-3149

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 139713 // CNNVD: CNNVD-201611-540

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201611-540

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-006879

PATCH
title:Update your ClickShare firmwareurl:https://www.barco.com/en/page/update-your-clickshare-firmware
Trust: 0.8
title:Barco ClickShare Fixes for remote code execution vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65875
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-006879 // 
            
            
            
            CNNVD: CNNVD-201611-540

EXTERNAL IDS
db:NVDid:CVE-2016-3149
Trust: 3.0
db:PACKETSTORMid:139713
Trust: 2.7
db:BIDid:94323
Trust: 2.1
db:JVNDBid:JVNDB-2016-006879
Trust: 0.8
db:CNNVDid:CNNVD-201611-540
Trust: 0.7
db:VULHUBid:VHN-91968
Trust: 0.1
db:VULMONid:CVE-2016-3149
Trust: 0.1
sources:
            
            
            VULHUB: VHN-91968 // 
            
            
            
            VULMON: CVE-2016-3149 // 
            
            
            
            BID: 94323 // 
            
            
            
            JVNDB: JVNDB-2016-006879 // 
            
            
            
            PACKETSTORM: 139713 // 
            
            
            
            CNNVD: CNNVD-201611-540 // 
            
            
            
            NVD: CVE-2016-3149

REFERENCES
url:http://packetstormsecurity.com/files/139713/barco-clickshare-xss-remote-code-execution-path-traversal.html
Trust: 2.6
url:http://www.securityfocus.com/bid/94323
Trust: 1.9
url:http://www.securityfocus.com/archive/1/539754/100/0/threaded
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3149
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3149
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/539754/100/0/threaded
Trust: 0.6
url:https://www.barco.com/en/clickshare
Trust: 0.3
url:http://seclists.org/bugtraq/2016/nov/49
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3149
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3151
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3152
Trust: 0.1
url:http://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=r33050037&rev=001001000113
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3150
Trust: 0.1
url:http://www.barco.com/en/mybarco/mysupport/documentation/software/software-detail?nr=r33050020&rev=001002000009
Trust: 0.1
url:https://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=r33050070&rev=001001000008
Trust: 0.1
sources:
            
            
            VULHUB: VHN-91968 // 
            
            
            
            VULMON: CVE-2016-3149 // 
            
            
            
            BID: 94323 // 
            
            
            
            JVNDB: JVNDB-2016-006879 // 
            
            
            
            PACKETSTORM: 139713 // 
            
            
            
            CNNVD: CNNVD-201611-540 // 
            
            
            
            NVD: CVE-2016-3149

CREDITS
Vincent Ruijter
Trust: 1.0
sources:
            
            
            BID: 94323 // 
            
            
            
            PACKETSTORM: 139713 // 
            
            
            
            CNNVD: CNNVD-201611-540

SOURCES
db:VULHUBid:VHN-91968
db:VULMONid:CVE-2016-3149
db:BIDid:94323
db:JVNDBid:JVNDB-2016-006879
db:PACKETSTORMid:139713
db:CNNVDid:CNNVD-201611-540
db:NVDid:CVE-2016-3149

LAST UPDATE DATE
2025-04-20T23:13:23.916000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-91968date:2018-10-09T00:00:00
db:VULMONid:CVE-2016-3149date:2018-10-09T00:00:00
db:BIDid:94323date:2016-11-24T00:10:00
db:JVNDBid:JVNDB-2016-006879date:2017-01-27T00:00:00
db:CNNVDid:CNNVD-201611-540date:2017-01-13T00:00:00
db:NVDid:CVE-2016-3149date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-91968date:2017-01-12T00:00:00
db:VULMONid:CVE-2016-3149date:2017-01-12T00:00:00
db:BIDid:94323date:2016-11-14T00:00:00
db:JVNDBid:JVNDB-2016-006879date:2017-01-27T00:00:00
db:PACKETSTORMid:139713date:2016-11-14T17:07:07
db:CNNVDid:CNNVD-201611-540date:2016-11-25T00:00:00
db:NVDid:CVE-2016-3149date:2017-01-12T23:59:00.260