← Vulnerability feed

Vulnerability record · CVE-2022-26233 · published 3 April 2022

CVE-2022-26233: Barco control room management suite path traversal vulnerability

BBarco · Control Room Management Suite

Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring.

7.5 CVSS 3.1 High EPSS 15% · top 3.4% CWE-22 · Path traversal
7.5CVSS 3.1 base score, v2 5.0
15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2022/Apr/0 ExploitMailing ListThird Party Advisory
http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2022/Apr/0 ExploitMailing ListThird Party Advisory

Track CVE-2022-26233 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2022-26975Barco control room management suite improper authentication vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.EPSS 0.99%6.1CVE-2022-26974Barco control room management suite cross-site scripting vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input san…EPSS 0.55%6.1CVE-2022-26977Barco control room management suite cross-site scripting vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of i…EPSS 0.55%6.1CVE-2022-26978Barco control room management suite cross-site scripting vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_use…EPSS 0.55%6.1CVE-2022-26972Barco control room management suite cross-site scripting vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameter…EPSS 0.55%5.4CVE-2022-26976Barco control room management suite cross-site scripting vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of i…EPSS 0.44%5.3CVE-2022-26973Barco control room management suite error message information leak vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaki…EPSS 0.75%5.3CVE-2022-26971Barco control room management suite missing authentication for critical function vulnerabilityBarco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This uplo…EPSS 0.71%

Source: NIST National Vulnerability Database (record CVE-2022-26233), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.