PT-2019-10019 · Teracue · Enc-400

Stephen Shkardoon · Published 2019-03-17 · Updated 2019-03-25 · CVE-2018-20219

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices with firmware 2.56 and below

Description: An issue allows attackers to bypass authentication on the device's web administration panel. After successful authentication, the device sends an authentication cookie to the end user. This cookie is hard-coded to a string in the source code, specifically in the /usr/share/www/check.lp file. By setting this cookie in a browser, an attacker can maintain access to every ENC-400 device without knowing the password. The token remains static even if a user changes the password on the device.

Recommendations: For Teracue ENC-400 devices with firmware 2.56 and below, consider disabling access to the web administration panel until a patch is available. Restrict access to the /usr/share/www/check.lp file to minimize the risk of exploitation. Avoid using the hard-coded authentication cookie in the browser to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-20219

Affected Products

Enc-400

References · 6

• 🔥 https://exploit-db.com/exploits/46451 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-20219 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20219 · Vendor Advisory
• http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.html · Note
• http://seclists.org/fulldisclosure/2019/Feb/48 · Note
• https://zxsecurity.co.nz/research.html · Note