Barco ClickShare CVE-2026-100902

Requires network reachability to the ClickShare CX-20 Gen2 web/management interface and low-privilege authentication (PR:L) to the device; the attacker then abuses the Wallpaper Upload feature by supplying a malformed 'wallpaper' argument to the /wallpaper endpoint on firmware up to 02.26.00.0007. Limiting factors: valid credentials are needed (not unauthenticated), the impact is confined to denial of service (no data exposure or code execution), and exposure depends on the management interface being reachable by the attacker rather than isolated on a restricted VLAN.

This is an availability-only flaw of moderate concern. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) scores 7.1, driven entirely by high availability impact - VC/VI are both N, so there is no confidentiality or integrity loss, only denial of service (consistent with CWE-404, improper resource release). The signals are largely consistent: PR:L confirms authentication is required (low-privilege), AC:L means the crash is easy to trigger once authenticated, and the E:P (Proof-of-Concept) exploit maturity aligns with the disclosed POC. No EPSS score and no CISA KEV listing are provided; combined with a single-researcher VulDB disclosure and an unresponsive vendor, this indicates no evidence of widespread or active exploitation - it is a real but low-to-moderate priority issue, not a critical one. The PR:L requirement and DoS-only impact meaningfully cap real-world severity: an attacker gains nothing but the ability to knock a meeting-room appliance offline, and must first authenticate. Missing data to note: no independent NVD/vendor advisory confirms the affected version boundary beyond VulDB, and there is no patched-version reference since the vendor did not respond.

A low-privileged authenticated user on the network (or an attacker with captured/guessed device credentials) sends a crafted request to the /wallpaper upload endpoint with a malformed 'wallpaper' argument, exhausting or improperly releasing a device resource and crashing the ClickShare unit, taking the meeting room offline. A public proof-of-concept exists (GitHub, 0xWKZER Barco001.md), lowering the effort to reproduce. Given AC:L, the crash is reliably triggerable once authenticated.