RSS   Vulnerabilities for 'Enc-400 hdsdi firmware'   RSS

2019-03-21
 
CVE-2018-20220

CWE-287
 

 
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.

 
 
CVE-2018-20219

CWE-798
 

 
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to the end user such that they can access the devices web administration panel. This token is hard-coded to a string in the source code (/usr/share/www/check.lp file). By setting this cookie in a browser, an attacker is able to maintain access to every ENC-400 device without knowing the password, which results in authentication bypass. Even if a user changes the password on the device, this token is static and unchanged.

 
 
CVE-2018-20218

CWE-78
 

 
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.

 

 >>> Vendor: Teracue 3 Products
Enc-400 hdmi2 firmware
Enc-400 hdmi firmware
Enc-400 hdsdi firmware


Copyright 2024, cxsecurity.com

 

Back to Top