CVE-2025-34035

Katalog CVE

CVSS 9.8 · Critical EPSS 22,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada engeniustech esr300 firmware, engeniustech esr350 firmware +5 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.

Rincian

Terbit di NVD

24 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

22,8% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cxsecurity.com/issue/WLB-2017060050 exploit · advisory pihak ketiga
• https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service advisory pihak ketiga
• https://www.exploit-db.com/exploits/42114 exploit · advisory pihak ketiga
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php exploit · advisory pihak ketiga
• https://packetstormsecurity.com/files/142792 broken link