Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-20220. PoCs published by Stephen Shkardoon.
AI-analyzed exploit summary The document describes multiple vulnerabilities in Teracue ENC-400 firmware v2.56 or below, including command injection (CVE-2018-20218), hard-coded authentication token (CVE-2018-20219), and missing authentication on sensitive endpoints (CVE-2018-20220). It details exploitation methods and incomplete vendor fixes.
Description
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.
Exploits (1)
The document describes multiple vulnerabilities in Teracue ENC-400 firmware v2.56 or below, including command injection (CVE-2018-20218), hard-coded authentication token (CVE-2018-20219), and missing authentication on sensitive endpoints (CVE-2018-20220). It details exploitation methods and incomplete vendor fixes.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N