CVE-2025-34035: critical vulnerability in EnGenius EnShare IoT Gigabit Cloud Service
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 10epss 25%
from disclosure to weapon
Published on NVDJun 24
VulnCheckJun 23
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
EnGenius · EnShare IoT Gigabit Cloud Servicepublic PoCs found — 4
cve_referencecxsecurity.com/issue/WLB-2017060050unverifiedcve_referencepacketstormsecurity.com/files/142792unverifiedcve_referencewww.exploit-db.com/exploits/42114unverifiedcve_referencewww.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.phpunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.