CVE-2022-26233

Deeper analysis

Barco Control Room Management through Suite 2.9 Build 0275 contains a directory traversal vulnerability tracked as CVE-2022-26233. The flaw, classified under CWE-22, permits remote attackers to read arbitrary files and components by crafting HTTP requests that begin with the substring "GET /..\..". It carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and no required authentication or user interaction, resulting in high impact to confidentiality.

Unauthenticated attackers reachable over the network can exploit the issue simply by submitting the specified traversal requests, enabling them to retrieve sensitive information and internal components without any prior credentials or user assistance. The attack requires only standard HTTP access to the affected management interface.

Public disclosures on Packet Storm and Full Disclosure detail the traversal technique but do not describe vendor patches or configuration workarounds. The EPSS score reached a peak of 0.8422 before receding to its current value of 0.7004, indicating sustained external interest in the vulnerability after publication.