CVE-2018-20220

EPSS 15.4%

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.htmlnão verificado exploitdbwww.exploit-db.com/exploits/46451não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.html http://seclists.org/fulldisclosure/2019/Feb/48 https://zxsecurity.co.nz/research.html