Description
A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes improper validation of syntactic correctness of input. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch ASAP
AI Analysis

Impact

The flaw resides in the wallpaper upload feature of Barco ClickShare CX‑20 Gen2 devices up to firmware 02.26.00.0007. An attacker can send a crafted "wallpaper" argument to the /wallpaper endpoint, and the device does not properly validate the syntactic correctness of this input. This oversight can cause the device to crash or freeze, leading to a denial‑of‑service condition. The weakness aligns with CWE‑20 (Improper Input Validation) and CWE‑1286 (Improper Parameter Validation).

Affected Systems

Barco ClickShare CX‑20 Gen2 devices running firmware versions up to 02.26.00.0007 are impacted by the flaw in the wallpaper upload component. No other vendors or product lines are listed as affected.

Risk and Exploitability

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score of <1% indicates a low current likelihood of exploitation, but this does not lessen the potential impact of a successful remote denial‑of‑service attack. The flaw is not yet listed in the CISA KEV catalog. An attacker only needs network access to the device's /wallpaper endpoint to deliver an invalid wallpaper argument and force the system to become unresponsive, disrupting meeting room operations.

Generated by OpenCVE AI on September 28, 2026 at 20:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the ClickShare CX‑20 Gen2 firmware to a version newer than 02.26.00.0007, which resolves the denial‑of‑service issue in the wallpaper upload component.
  • Apply network segmentation or firewall rules to restrict external access to the ClickShare device, ensuring that only trusted hosts can reach the wallpaper upload interface.
  • If the device configuration allows, disable the wallpaper upload capability to eliminate the attack surface.

Generated by OpenCVE AI on September 28, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-404

Mon, 28 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes improper validation of syntactic correctness of input. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper denial of service Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input
Weaknesses CWE-1286
CWE-20
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 6.8, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:TF/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:T/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:T/RC:R'}

Mon, 28 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper denial of service
First Time appeared Barco
Barco clickshare Cx-20 Gen2
Weaknesses CWE-404
CPEs cpe:2.3:a:barco:clickshare_cx-20_gen2:*:*:*:*:*:*:*:*
Vendors & Products Barco
Barco clickshare Cx-20 Gen2
References
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Barco Clickshare Cx-20 Gen2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T18:35:10.382Z

Reserved: 2026-09-27T08:54:38.088Z

Link: CVE-2026-100902

cve-icon Vulnrichment

Updated: 2026-09-28T12:57:44.156Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T04:16:56.207

Modified: 2026-09-28T19:16:46.360

Link: CVE-2026-100902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T20:30:06Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-20

    Improper Input Validation