critical9.8Public exploit code
CVE-2018-20218
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Teracue ENC-400 - Command Injection / Missing Authentication2019-02-22 · webapps · hardware
Impact
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teracue | Enc-400 Hdmi Firmware | through 2.56 |
| Teracue | Enc-400 Hdmi2 Firmware | through 2.56 |
| Teracue | Enc-400 Hdsdi Firmware | through 2.56 |