Description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EnGenius | EnShare IoT Gigabit Cloud Service | ≤ 1.4.11 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution http/cves/2025/CVE-2025-34035.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php third-party-advisory exploit
- https://www.exploit-db.com/exploits/42114 third-party-advisory exploit
- https://packetstormsecurity.com/files/142792 third-party-advisory exploit
- https://cxsecurity.com/issue/WLB-2017060050 third-party-advisory exploit
- https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service third-party-advisory