CVE-2018-20218
CRITICALTeracue ENC-400 <2.56 - Command Injection
Title source: llmDescription
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.
Exploits (1)
Scores
CVSS v3
9.8
EPSS
0.3068
EPSS Percentile
96.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (3)
teracue/enc-400_hdmi2_firmware
< 2.56
teracue/enc-400_hdmi_firmware
< 2.56
teracue/enc-400_hdsdi_firmware
< 2.56
Published
Mar 21, 2019
Tracked Since
Feb 18, 2026