by Kastro
Paper/Archive/CVE-2025-34035

CVE-2025-34035

EnGenius EnShare IoT Gigabit Cloud Service — EnGenius EnShare IoT Gigabit Cloud Service Command Injection

EPSS 25%public exploitCVSS 10.0
critical.is priorityof 100
60
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 97.9.979 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.

Affected

ProductAffectedFixed inSource
EnShare IoT Gigabit Cloud Service≤ 1.4.11–CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitzeroscience.mk/en/vulnerabilities/ZSL-2017-5413.phpexploitexploit-db.com/exploits/42114exploitpacketstormsecurity.com/files/142792exploitcxsecurity.com/issue/WLB-2017060050writeupvulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service