Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Barco ClickShare Base Unit allows remote takeover via web API

CVE-2017-9377 · published 9 years ago
Summary

The Barco ClickShare Base Unit firmware versions CSM-1 before 1.7.0.3 and CSC-1 before 1.10.0.10 can be tricked into running unauthorized commands when someone accesses its web API. This could let an attacker take full control of the device and any network it’s connected to. Update the firmware to the latest version as soon as possible or restrict access to the web API.

What to do
  • Update barco clickshare_csm-1_firmware to version 1.7.0.3 or later.
  • Update barco clickshare_csc-1_firmware to version 1.10.0.10 or later.
Affected software
VendorProductAffected versions
barco clickshare_csm-1_firmware < 1.7.0.3
cpe:2.3:o:barco:clickshare_csm-1_firmware:*:*:*:*:*:*:*:*
barco clickshare_csc-1_firmware < 1.10.0.10
cpe:2.3:o:barco:clickshare_csc-1_firmware:*:*:*:*:*:*:*:*
Original advisory text
A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can...
A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can exploit this vulnerability to completely compromise the vulnerable device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
4% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published30 Oct 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-9377 · NVD
Track software like this
Free during beta