CVE-2020-28331

Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a device configuration file variable to see if the SSH daemon should be started. The web interface does not provide a visible capability to alter this configuration file variable. However, a malicious actor can include this variable in a POST such that the SSH daemon will be started when the device boots.

• http://packetstormsecurity.com/files/160162/Barco-wePresent-Undocumented-SSH-Interface.htmlThird Party Advisory, VDB Entry
• https://korelogic.com/Resources/Advisories/KL-001-2020-007.txtThird Party Advisory
• http://packetstormsecurity.com/files/160162/Barco-wePresent-Undocumented-SSH-Interface.htmlThird Party Advisory, VDB Entry
• https://korelogic.com/Resources/Advisories/KL-001-2020-007.txtThird Party Advisory

Published

Nov 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28326Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28327A res_pjsip_session crash was discovered in Asterisk Open So…5.3
• CVE-2020-28328SuiteCRM before 7.11.17 is vulnerable to remote code executi…8.8
• CVE-2020-28329Barco wePresent WiPG-1600W firmware includes a hardcoded API…9.8
• CVE-2020-2833Vulnerability in the Oracle Quoting product of Oracle E-Busi…8.2
• CVE-2020-28330Barco wePresent WiPG-1600W devices have Unprotected Transpor…6.5
• CVE-2020-28332Barco wePresent WiPG-1600W devices download code without an …9.8
• CVE-2020-28333Barco wePresent WiPG-1600W devices allow Authentication Bypa…9.8
• CVE-2020-28334Barco wePresent WiPG-1600W devices use Hard-coded Credential…9.8
• CVE-2020-28337A directory traversal issue in the Utils/Unzip module in Mic…7.2
• CVE-2020-28339The usc-e-shop (aka Collne Welcart e-Commerce) plugin before…8.8
• CVE-2020-2834Vulnerability in the Oracle Marketing product of Oracle E-Bu…8.2