Vulnerability · Published Jun 24, 2025 · Assigned by VulnCheck
CVE-2025-34035EnGenius EnShare IoT Gigabit Cloud Service Command Injection
Critical 10.0
In plain English
A critical-severity OS command injection in EnShare IoT Gigabit Cloud Service from EnGenius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 24.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EnGenius | EnShare IoT Gigabit Cloud Service | 0 – through 1.4.11 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php third-party-advisory, exploit
- https://www.exploit-db.com/exploits/42114 third-party-advisory, exploit
- https://packetstormsecurity.com/files/142792 third-party-advisory, exploit
- https://cxsecurity.com/issue/WLB-2017060050 third-party-advisory, exploit
- https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service third-party-advisory