CVEvulnerability
CVE-2021-38142
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-319
Description
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).
Affected configurations
• barco mirrorop windows sender (< 2.5.3.65)
Related
Weakness · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
References
- https://www.barco.com/en/support/cms Vendor Advisory
- https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65 Release Notes, Vendor Advisory
- https://www.barco.com/en/support/cms Vendor Advisory
- https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65 Release Notes, Vendor Advisory