Description

A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-28T04:16:56.207Z",
  "pubdate": "2026-09-28T04:16:56.207Z",
  "executiveSummary": "A denial of service vulnerability exists within the Barco ClickShare CX-20 Gen2 firmware up to version 02.26.00.0007. The vulnerability resides in the Wallpaper Upload component, specifically affecting the /wallpaper endpoint. By manipulating the wallpaper argument, a remote, unauthenticated attacker can cause the device to enter a state of denial of service. This vulnerability poses a significant risk to operational continuity, as the affected ClickShare device becomes unresponsive and unable to perform its primary function of wireless conferencing and presentation. Given that the exploit has been publicly disclosed and the vendor has remained unresponsive to disclosure attempts, the risk of exploitation is elevated. Organizations utilizing these devices should implement immediate network-level restrictions to prevent unauthorized access to the affected interface.",
  "technicalDetails": "The vulnerability is situated within the Wallpaper Upload component of the Barco ClickShare CX-20 Gen2, which provides functionality for users to customize the device's standby screen. The root cause of the denial of service appears to be improper input validation or insufficient error handling within the /wallpaper endpoint when processing the wallpaper argument. Because the interface is exposed remotely, an attacker can transmit a specially crafted request containing malicious or malformed data to the endpoint.\nThe attack flow involves the attacker sending an HTTP request directed at the /wallpaper file, targeting the specific parameter intended for file handling or configuration. Upon receiving the crafted payload, the underlying service or application logic, which manages the processing of the uploaded image or configuration file, encounters an unhandled exception or enters an infinite loop. This failure results in the crash of the associated system process or the exhaustion of system resources, causing the device to stop responding to legitimate user traffic or control signals.\nThe affected versions include Barco ClickShare CX-20 Gen2 firmware up to 02.26.00.0007. The vulnerability is exploitable remotely, requiring no prior authentication or administrative privileges, which increases the potential attack surface. The payload behavior is destructive to service availability, effectively forcing a device hang or reboot cycle that prevents normal operation. As the functionality involves file uploads or configuration updates, the system likely fails when attempting to parse or write the manipulated argument to the filesystem or memory buffer, leading to process termination. The impact is a complete disruption of the conferencing session functionality, necessitating a hard reset or power cycle to restore the device to its normal operating state. Since the exploit is publicly available, any device with network connectivity to the management interface is at risk."
}