CVE-2024-11651

CVE-2024-11651 is a command injection vulnerability (CWE-77) in the web management interface of EnGenius ENH1350EXT, ENS500-AC and ENS620EXT firmware up to and including the 20241118 build. An attacker triggers it by submitting a crafted value in the wifi_schedule_day_em_5 parameter to the /admin/network/wifi_schedule endpoint, where it is passed to an OS shell without sanitization; the attack is launched remotely, and the CVSS 4.0 vector indicates administrator-level privileges are required. Successful injection allows execution of arbitrary OS commands on the access point, giving the attacker control over the device and a potential foothold in the network it serves, though CVSS 4.0 rates the direct impact as low. Any deployment of these three legacy EnGenius outdoor/business access points running firmware dated 20241118 or earlier is affected, with the highest risk on devices whose admin interface is internet-reachable or that use default or shared admin credentials. A public proof-of-concept has been disclosed, the vendor was contacted before disclosure but did not respond, and EPSS assigns a 27.4% probability of exploitation within 30 days (98th percentile), though the flaw is not yet in CISA's KEV and no confirmed in-the-wild exploitation is documented.

What to do: No fixed firmware version is confirmed in available data and the vendor did not respond at disclosure, so verify your model and firmware date (20241118 or earlier means affected) and check EnGenius support channels for an updated release. In the meantime, restrict each device's management interface to a trusted management VLAN or VPN rather than the internet, and eliminate default or shared admin credentials since administrator privileges are required for exploitation. Treat these as legacy devices and evaluate replacement if no patched firmware appears.