CVE-2026-100902 Details
Description
A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes improper validation of syntactic correctness of input. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A denial-of-service vulnerability has been identified in the Barco ClickShare CX-20 Gen2, specifically in the Wallpaper Upload feature. This issue affects devices running firmware versions through 02.26.00.0007. The vulnerability arises from improper input validation in the wallpaper upload functionality, allowing an authenticated attacker to upload a crafted polyglot JPEG file. This file, containing trailing data, is not properly validated beyond the initial magic bytes, leading to an unhandled server exception that causes a persistent denial-of-service condition. The issue can be exploited remotely, and the device requires a full factory reset to restore functionality.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xWKZER/-security-disclosures/blob/main/Barco001.md | [email protected] | ExploitRemedyTechnical Description |
| https://vuldb.com/cve/CVE-2026-100902 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/919384 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/410852 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/410852/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Barco ClickShare CX-20 Gen2 | <= 02.26.00.0007 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | [email protected] |
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 28, 2026 | New CVE Received | [email protected] |