9.8

CVE-2025-34035

Exploit

EnGenius EnShare IoT Gigabit Cloud Service Command Injection

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Engeniustech ≫ Esr300 Firmware Version 1.1.0.28
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.3.1.42
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.4.0
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.4.1.28
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.4.2
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.4.7
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr300 Firmware Version 1.4.9
   Engeniustech ≫ Esr300 Version -
Engeniustech ≫ Esr350 Firmware Version 1.1.0.29
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.3.1.41
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.4.0
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.4.2
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.4.5
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.4.9
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr350 Firmware Version 1.4.11
   Engeniustech ≫ Esr350 Version -
Engeniustech ≫ Esr600 Firmware Version 1.1.0.50
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.2.1.46
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.3.1.63
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.0.23
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.1
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.2
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.3
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.5
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.9
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr600 Firmware Version 1.4.11
   Engeniustech ≫ Esr600 Version -
Engeniustech ≫ Esr900 Firmware Version 1.1.0
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.2.2.23
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.3.0
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.3.1.26
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.3.5.18
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.4.0
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.4.3
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr900 Firmware Version 1.4.5
   Engeniustech ≫ Esr900 Version -
Engeniustech ≫ Esr1200 Firmware Version 1.1.0
   Engeniustech ≫ Esr1200 Version -
Engeniustech ≫ Esr1200 Firmware Version 1.3.1.34
   Engeniustech ≫ Esr1200 Version -
Engeniustech ≫ Esr1200 Firmware Version 1.4.1
   Engeniustech ≫ Esr1200 Version -
Engeniustech ≫ Esr1200 Firmware Version 1.4.3
   Engeniustech ≫ Esr1200 Version -
Engeniustech ≫ Esr1200 Firmware Version 1.4.5
   Engeniustech ≫ Esr1200 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.1.0
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.2.2.27
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.3.0
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.3.1.34
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.4.0
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.4.1
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.4.3
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Esr1750 Firmware Version 1.4.5
   Engeniustech ≫ Esr1750 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.2.0
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.0
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.2
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.3
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.3.17
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.7.20
   Engeniustech ≫ Epg5000 Version -
Engeniustech ≫ Epg5000 Firmware Version 1.3.9.21
   Engeniustech ≫ Epg5000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.33% 0.957
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 10 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://cxsecurity.com/issue/WLB-2017060050
Third Party Advisory
Exploit
https://packetstormsecurity.com/files/142792
Broken Link
https://www.exploit-db.com/exploits/42114
Third Party Advisory
Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php
Third Party Advisory
Exploit
https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service
Third Party Advisory