CVE-2018-20218

high-risk
Published 2019-03-21

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.

Do I need to act?

!
30.7% chance of exploitation in next 30 days
EPSS score — higher than 69% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
46451
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Teracue

References (4)

Exploit http://seclists.org/fulldisclosure/2019/Feb/48
Not Applicable https://zxsecurity.co.nz/research.html
Exploit http://seclists.org/fulldisclosure/2019/Feb/48
Not Applicable https://zxsecurity.co.nz/research.html
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 16/34 · Moderate
Exposure 9/34 · Low