what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Teracue ENC-400 Command Injection / Missing Authentication

Teracue ENC-400 Command Injection / Missing Authentication
Posted Feb 20, 2019
Authored by Stephen Shkardoon

Teracue ENC-400 suffers from hard-coded credential, missing authentication, and command injection vulnerabilities.

tags | exploit, vulnerability, bypass
advisories | CVE-2018-20219, CVE-2018-20220
SHA-256 | 86b6179ce97f3abb7bdb587da6b1829dbc68fca0ee8bd26bbc694d7d49d2eff2

Teracue ENC-400 Command Injection / Missing Authentication

Change Mirror Download


Multiple vulnerabilities were identified within the Teracue ENC-400,
including pre-authenticated remote code authentication. While the vendor
has released updated firmware after these issues were identified, they are
not all resolved with the latest version of the firmware.


The Teracue ENC-400 is accessible over an HTTP interface, which allows
device configuration (including setting passwords or video stream
destinations and servers). The vendor describes the device as follows:
This HD/SD H.264 fanless video encoder is able to deliver multiple streams
in multiple bitrates and protocols to multiple destinations. [1]

These issues affect firmware versions v2.56 or below.
Note that the latest version of firmware, v2.57, does not adequately
resolve all identified issues. Specific notes have been added to issues in
the Technical Details section.

Technical Details

1) Command injection in login form

The login form passes user input directly to a shell command without any
kind of escaping or validation.
In the file /usr/share/www/check.lp:
#!/usr/bin/env cgilua.cgi
local pass = cgilua.POST.password
local com1 = os.execute("echo \'"..cgilua.POST.password.."\' | (su -c

An attacker is able to perform command injection using the "password"
parameter displayed on the login form. An example "password" to bypass this
authentication would be:
f' > /dev/null #

It is also possible for an attacker to simply execute code directly on the

* Resolution Status *
While this instance of remote code execution has been resolved, the
resolution does not protect the entire codebase.
In /usr/share/www/web/system_password.lp:
local oldpass = cgilua.POST.oldpass
local newpass = cgilua.POST.newpass
local com1=os.execute("echo '"..oldpass.."' | (su -c 'echo '"..oldpass.."'
| (su root -c '/bin/true') > /dev/null 2>&1 ; echo $?')")

This allows an authenticated user to execute commands without knowing the
existing password. This is particularly important given the insufficient
resolution of CVE-2018-20219 (issue 2).

2) Hard-coded authentication token

After successful authentication, the device sends an authentication cookie
to the end user such that they can access the devices web administration
panel. This token is hardcoded to a string in the source code.
In the file /usr/share/www/check.lp:


(Note: Line may be slightly different in different firmware versions,
though the token is still the same).

By simply setting this cookie in a browser, an attacker is able to maintain
access to every ENC-400 device without knowing the password. Even if a user
changes the password on the device, this token is static and unchanged.
This results in an authentication bypass.

* Resolution Status *
While this cookie is now dynamically generated, the latest code generates
cookie values from the current time in seconds.
In the file /usr/share/www/check.lp:
local cookie_value=RandomVariable(30)

An attacker is able to trivially bypass authentication simply by knowing
the approximate time of the last successful authentication.

2) Missing authentication on sensitive endpoints

While the web interface requires authentication before it can be interacted
with, a large portion of the HTTP endpoints are missing authentication.
The "/configuration.xml" file, for example, includes all information
required to access a video stream, such as the IP and port information, and
any encryption information if specified.

* Resolution Status *
No verification was performed as to whether this issue was appropriately
resolved, or whether other files may be left unprotected.

Disclosure Timeline

Attempts to contact vendor begin: August 30, 2018
Vendor contacted: September 7, 2018
Vendor acknowledges issues: October 23, 2018
Initial fixes released for testing: December 4, 2018
Response indicating insufficient fixes: December 4, 2018
Public firmware release: February 13, 2019


[1] https://www.teracue.com/en/iptv-products/encoding

Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    32 Files
  • 5
    Dec 5th
    10 Files
  • 6
    Dec 6th
    13 Files
  • 7
    Dec 7th
    23 Files
  • 8
    Dec 8th
    19 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By