https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-26978.htmlhttps://patchthecve.com/cve/CVE-2022-26978.htmlWed, 17 Jun 2026 04:36:15 +0000MEDIUM 6.1: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username parameters is not correctly sanitized, leading to reflected XSS.https://patchthecve.com/cve/CVE-2022-26977.htmlhttps://patchthecve.com/cve/CVE-2022-26977.htmlWed, 17 Jun 2026 04:36:15 +0000MEDIUM 6.1: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization of the upload mechanism is leads to stored XSS.https://patchthecve.com/cve/CVE-2022-26976.htmlhttps://patchthecve.com/cve/CVE-2022-26976.htmlWed, 17 Jun 2026 04:36:15 +0000MEDIUM 5.4: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.https://patchthecve.com/cve/CVE-2022-26975.htmlhttps://patchthecve.com/cve/CVE-2022-26975.htmlWed, 17 Jun 2026 04:36:14 +0000HIGH 7.5: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.https://patchthecve.com/cve/CVE-2022-26974.htmlhttps://patchthecve.com/cve/CVE-2022-26974.htmlWed, 17 Jun 2026 04:36:14 +0000MEDIUM 6.1: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS.https://patchthecve.com/cve/CVE-2022-26973.htmlhttps://patchthecve.com/cve/CVE-2022-26973.htmlWed, 17 Jun 2026 04:36:14 +0000MEDIUM 5.3: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details.https://patchthecve.com/cve/CVE-2022-26972.htmlhttps://patchthecve.com/cve/CVE-2022-26972.htmlWed, 17 Jun 2026 04:36:14 +0000MEDIUM 6.1: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS.https://patchthecve.com/cve/CVE-2022-26971.htmlhttps://patchthecve.com/cve/CVE-2022-26971.htmlWed, 17 Jun 2026 04:36:14 +0000MEDIUM 5.3: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication.https://patchthecve.com/cve/CVE-2022-26233.htmlhttps://patchthecve.com/cve/CVE-2022-26233.htmlWed, 17 Jun 2026 04:34:51 +0000HIGH 7.5: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring.https://patchthecve.com/cve/CVE-2021-38142.htmlhttps://patchthecve.com/cve/CVE-2021-38142.htmlWed, 17 Jun 2026 04:01:33 +0000HIGH 8.8: Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protectehttps://patchthecve.com/cve/CVE-2021-35482.htmlhttps://patchthecve.com/cve/CVE-2021-35482.htmlWed, 17 Jun 2026 03:57:32 +0000HIGH 7.8: An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution (with user privileges of the local user) on any device that tries to connect to a WePresent presentation system.https://patchthecve.com/cve/CVE-2020-17504.htmlhttps://patchthecve.com/cve/CVE-2020-17504.htmlWed, 17 Jun 2026 02:59:01 +0000HIGH 7.2: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modulehttps://patchthecve.com/cve/CVE-2020-17503.htmlhttps://patchthecve.com/cve/CVE-2020-17503.htmlWed, 17 Jun 2026 02:59:01 +0000HIGH 7.2: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "lockinghttps://patchthecve.com/cve/CVE-2020-17502.htmlhttps://patchthecve.com/cve/CVE-2020-17502.htmlWed, 17 Jun 2026 02:59:01 +0000HIGH 7.2: Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An ihttps://patchthecve.com/cve/CVE-2020-17500.htmlhttps://patchthecve.com/cve/CVE-2020-17500.htmlWed, 17 Jun 2026 02:59:01 +0000CRITICAL 9.8: Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result inhttps://patchthecve.com/cve/CVE-2020-28329.htmlhttps://patchthecve.com/cve/CVE-2020-28329.htmlWed, 17 Jun 2026 03:10:17 +0000CRITICAL 9.8: Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.https://patchthecve.com/cve/CVE-2020-28334.htmlhttps://patchthecve.com/cve/CVE-2020-28334.htmlWed, 17 Jun 2026 03:10:17 +0000CRITICAL 9.8: Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28https://patchthecve.com/cve/CVE-2020-28333.htmlhttps://patchthecve.com/cve/CVE-2020-28333.htmlWed, 17 Jun 2026 03:10:17 +0000CRITICAL 9.8: Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET requehttps://patchthecve.com/cve/CVE-2020-28332.htmlhttps://patchthecve.com/cve/CVE-2020-28332.htmlWed, 17 Jun 2026 03:10:17 +0000CRITICAL 9.8: Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modifiedhttps://patchthecve.com/cve/CVE-2020-28330.htmlhttps://patchthecve.com/cve/CVE-2020-28330.htmlWed, 17 Jun 2026 03:10:17 +0000MEDIUM 6.5: Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listenihttps://patchthecve.com/cve/CVE-2020-28331.htmlhttps://patchthecve.com/cve/CVE-2020-28331.htmlWed, 17 Jun 2026 03:10:17 +0000HIGH 7.5: Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included in the firmware image. By default, the SSH daemon is disabled and does not start at system boot. The system initialization scripts read a de