CVE-2018-20220

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Feb/48Mailing List, Third Party Advisory
https://zxsecurity.co.nz/research.htmlNot Applicable
http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Feb/48Mailing List, Third Party Advisory
https://zxsecurity.co.nz/research.htmlNot Applicable

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202218.8Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted u CVE-2018-202229.8XXE issue in Airsonic before 10.1.2 during parse.CVE-2018-202257.8An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended CVE-2018-202267.2An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.to CVE-2018-202277.5RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.CVE-2018-202288.0Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.CVE-2018-202297.5GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.CVE-2018-202307.8An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.CVE-2018-202318.8Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA CVE-2018-202325.4The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inj CVE-2018-202336.5The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrato CVE-2018-202348.8There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercu