Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Barco ClickShare CS-100 and CSE-200 share encryption keys

CVE-2019-18825 · published 6 years ago
Summary

The CS-100 and CSE-200 ClickShare devices use the same encryption key for storing passwords, so if one device is compromised the stored credentials on any similar device can be read. This could let an attacker gain access to the system’s network or data. Update the firmware to version 1.9.0 or later on all affected units to get proper key separation.

What to do
  • Update barco clickshare_cs-100_huddle_firmware to version 1.9.0 or later.
  • Update barco clickshare_cse-200_firmware to version 1.9.0 or later.
Affected software
VendorProductAffected versions
barco clickshare_cs-100_huddle_firmware < 1.9.0
cpe:2.3:o:barco:clickshare_cs-100_huddle_firmware:*:*:*:*:*:*:*:*
barco clickshare_cse-200_firmware < 1.9.0
cpe:2.3:o:barco:clickshare_cse-200_firmware:*:*:*:*:*:*:*:*
Original advisory text
Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption k...
Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption keys which are shared across all ClickShare Base Units of models CS-100 & CSE-200.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published17 Dec 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-18825 · NVD
Track software like this
Free during beta