What’s Vulnerable › Vulnerabilities

CVE-2018-20218

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-21 · updated 2026-06-17
• Weakness: CWE-78

Description

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.

Affected products

• Teracue Enc-400 Hdmi2 Firmware: through 2.56
• Teracue Enc-400 Hdmi Firmware: through 2.56
• Teracue Enc-400 Hdsdi Firmware: through 2.56

References

• http://seclists.org/fulldisclosure/2019/Feb/48
• https://zxsecurity.co.nz/research.html
• http://seclists.org/fulldisclosure/2019/Feb/48
• https://zxsecurity.co.nz/research.html

Get alerted when CVE-2018-20218 or the next vulnerability affects your stack