CVE-2020-17502

Name of the Vulnerable Software and Affected Versions: Barco TransForm N versions prior to 3.8

Description: The issue allows authenticated users of the administration panel to perform authenticated remote code execution due to a command injection problem. This problem exists in the split card cmd.php file, where the HTTP parameters xmodules, ymodules, and savelocking are not properly handled. The web administration panel is made available over HTTPS.

Recommendations: For versions prior to 3.8, update to version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the split card cmd.php file and the HTTP parameters xmodules, ymodules, and savelocking to minimize the risk of exploitation.