CVE-2025-34035
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
- State
- Published
- Severity
- 10.0 Critical
- Published
- Jun 24, 2025
- Updated
- Apr 7, 2026
- Reserved
- Apr 15, 2025
Description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
EnShare IoT Gigabit Cloud ServiceEnGenius |
|
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.phpthird-party-advisoryexploit
- https://www.exploit-db.com/exploits/42114third-party-advisoryexploit
- https://packetstormsecurity.com/files/142792third-party-advisoryexploit
- https://cxsecurity.com/issue/WLB-2017060050third-party-advisoryexploit
- https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-servicethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.