CVE-2018-20218: Teracue Enc-400 HDMI2 Firmware

Critical severity, CVSS 9.8. EPSS: 10.7% chance of exploitation in the next 30 days.

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.

Affected products

• Teracue Enc-400 HDMI2 Firmware: up to and including 2.56
• Teracue Enc-400 Hdmi Firmware: up to and including 2.56
• Teracue Enc-400 Hdsdi Firmware: up to and including 2.56

Published 2019-03-21. Last modified 2026-06-17.