CVE-2018-20218
21.03.2019, 16:00
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.
| Vendor | Product | Version |
|---|---|---|
| teracue | enc-400_hdmi_firmware | 𝑥 ≤ 2.56 |
| teracue | enc-400_hdmi2_firmware | 𝑥 ≤ 2.56 |
| teracue | enc-400_hdsdi_firmware | 𝑥 ≤ 2.56 |
𝑥
= Vulnerable software versions