Command Injection Vulnerability in EnGenius Wireless Products
CVE-2024-11659

7.2HIGH

Key Information:

Vendor

EnGenius

Status
Enh1350ext Firmware
Vendor
CVE Published:
25 November 2024

What is CVE-2024-11659?

A significant command injection vulnerability has been identified in EnGenius network devices, specifically in the ENH1350EXT, ENS500-AC, and ENS620EXT models up to version 20241118. The flaw exists within the network diagnostic functionality of the admin interface, particularly in the script /admin/network/diag_iperf. Malicious actors can exploit this vulnerability by manipulating the 'iperf' argument, potentially allowing for unauthorized command execution. This vulnerability can be triggered remotely, raising serious security concerns for users of these products. Despite early notifications to the vendor about this vulnerability, no protective measures or responses have been reported, leaving systems at risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://k9u7kv33ub.feishu.cn/wiki/OhR6w0THjiFeV1kSfZncaCx...
https://vuldb.com/?ctiid.285980
https://vuldb.com/?id.285980

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.