by Kastro
Paper/Archive/CVE-2024-36061

CVE-2024-36061

engenius ews356_fit — EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.7.657 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection. This allows an attacker to execute arbitrary OS commands via shell metacharacters to the Ping and Speed Test utilities.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
ews356_fit≤ 1.1.30–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/actuator/cve/blob/main/Engenius/CVE-2024-36061