EnGenius EnShare IoT Gigabit Cloud Service Command Injection
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 10epss 13%
from disclosure to weapon
Published on NVDJun 24
VulnCheckJun 23
exploitation probability
13%top 4% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
EnGenius · EnShare IoT Gigabit Cloud Servicepublic PoCs found — 4
cve_referencecxsecurity.com/issue/WLB-2017060050unverifiedcve_referencepacketstormsecurity.com/files/142792unverifiedcve_referencewww.exploit-db.com/exploits/42114unverifiedcve_referencewww.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.phpunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.