# CVE-2026-100902: Barco ClickShare CX-20 Gen2 denial of service in wallpaper upload

Source: https://junglewise.ai/threats/cve-2026-100902-a-vulnerability-was-determined-in-barco-clickshare-cx-20-gen2-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-100902 · Severity: medium · CVSS 6.5 · Published 2026-09-28

Barco ClickShare CX-20 Gen2 is a wireless presentation device used in conference rooms and corporate environments. An authenticated attacker can upload a malformed image file to permanently disable the device's wallpaper functionality or entire web service, rendering it unusable until a factory reset is performed. The device fails to properly validate uploaded files, allowing crafted files to cause a crash that persists even after reboot.

Vendors: [Barco](https://junglewise.ai/threats/vendors/barco).

## Quick answers

**Is CVE-2026-100902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100902 being exploited in the wild.

**How severe is CVE-2026-100902?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** Barco ClickShare CX-20 Gen2 up to 02.26.00.0007.

**Is there a fix for CVE-2026-100902?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100902 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100902?** Check whether you run Barco ClickShare CX-20 Gen2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /wallpaper endpoint in Barco ClickShare CX-20 Gen2 firmware 02.26.00.0007 and earlier improperly validates file content, checking only magic bytes (FFD8FFE0) without validating the complete file structure. An authenticated attacker can upload a polyglot JPEG file with trailing data after the EOI marker (FFD9), causing an unhandled exception that triggers HTTP 500 and corrupts persistent storage. The broken state survives reboots and in some cases disables the entire HTTPS service, requiring factory reset to restore.

## Affected products

- Barco ClickShare CX-20 Gen2 up to 02.26.00.0007

## Timeline

- 2026-09-28: disclosed: Vulnerability publicly disclosed via GitHub
- 2026-08: other: Vulnerability discovered and vendor notified

## References

- [https://github.com/0xWKZER/-security-disclosures/blob/main/Barco001.md](https://github.com/0xWKZER/-security-disclosures/blob/main/Barco001.md)
- [https://vuldb.com/cve/CVE-2026-100902](https://vuldb.com/cve/CVE-2026-100902)