Sign In
Advisories

EnGenius EnShare Cloud Service Command Injection

Go Back
severity
critical
date
Affecting

  • EnShare Cloud Service <= 1.4.11

  • An affected version range remains undefined

CVE type
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS
10
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Credit
Gjoko Krstic of Zero Science
Description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.