Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-20218.
AI-analyzed exploit summary This is a detailed technical writeup describing multiple vulnerabilities in the Teracue ENC-400 device, including command injection (CVE-2018-20218), hard-coded authentication token (CVE-2018-20219), and missing authentication on sensitive endpoints (CVE-2018-20220). It provides code snippets, root cause analysis, and resolution status for each issue.
Description
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.
Exploits (1)
This is a detailed technical writeup describing multiple vulnerabilities in the Teracue ENC-400 device, including command injection (CVE-2018-20218), hard-coded authentication token (CVE-2018-20219), and missing authentication on sensitive endpoints (CVE-2018-20220). It provides code snippets, root cause analysis, and resolution status for each issue.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H