CVE-2020-17504

Name of the Vulnerable Software and Affected Versions: Barco TransForm N versions prior to 3.8

Description: The NDN-210 device has a web administration panel accessible over https, where a command injection issue allows authenticated users to perform remote code execution. This issue is due to improper handling of the http parameters x modules and y modules in the ngpsystemcmd.php file.

Recommendations: For versions prior to 3.8, update to TransForm N version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the ngpsystemcmd.php file and the x modules and y modules parameters to minimize the risk of exploitation.