CVE-2018-20218

published 2019-03-21

CVE-2018-20218: An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind…

Priority P2 69 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
teracue	enc-400_hdmi2_firmware	<= 2.56	—
teracue	enc-400_hdmi_firmware	<= 2.56	—
teracue	enc-400_hdsdi_firmware	<= 2.56	—

Detection & IOCs extracted from sources · hover to see the quote

cookie AuthByPasswdENC400=Teracue:dGFpOfrtmR1bW1thrf5dGV4nhyxxdA==↗

path /usr/share/www/check.lp↗

path /usr/share/www/web/system_password.lp↗

path /configuration.xml↗

• → Detect authentication bypass attempts by inspecting HTTP requests for the hardcoded cookie value 'AuthByPasswdENC400: Teracue:dGFpOfrtmR1bW1thrf5dGV4nhyxxdA==' — any request bearing this static token should be treated as suspicious. ↗
• → Monitor unauthenticated HTTP GET requests to /configuration.xml on ENC-400 devices, which exposes stream IP/port and encryption details without requiring authentication. ↗
• → On patched firmware (v2.57), detect authenticated command injection via the 'oldpass' POST parameter to system_password.lp — shell metacharacters in this field allow command execution without knowing the existing password. ↗
• → On v2.57 firmware, the authentication cookie is generated from os.time() (current Unix timestamp seeded via math.randomseed). Detect brute-force cookie guessing by monitoring rapid sequential authenticated requests with incrementally varying cookie values. ↗

• · Firmware v2.57 does NOT fully resolve all vulnerabilities. The hardcoded cookie is replaced with a time-seeded value, but this is trivially bypassable by knowing the approximate time of last successful authentication. Command injection persists in system_password.lp for authenticated users. ↗
• · The static hardcoded authentication token works across ALL ENC-400 devices regardless of configured password, and persists even after a password change on the device. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78