CVE-2024-11653

CVE-2024-11653 is a command injection vulnerability in the traceroute diagnostic function of EnGenius ENH1350EXT, ENS500-AC and ENS620EXT access point firmware, with all builds up to and including 20241118 affected. A remote attacker who holds valid administrative credentials can inject operating system commands through the diag_traceroute argument of the /admin/network/diag_traceroute page, gaining command execution on the device. The CVSS v4.0 vector (AV:N/PR:H/UI:N) shows the attack is remote but requires high privileges (admin access), and the 5.1 (medium) score reflects limited confidentiality, integrity and availability impact, although the disclosing source rated the issue critical. EnGenius was contacted ahead of disclosure but did not respond, and no fixed firmware is confirmed in the available data. A public proof-of-concept is available, the flaw is not yet in CISA KEV, and EPSS assigns a 29.1% probability of exploitation within 30 days (98th percentile), indicating elevated risk.

What to do: Inventory networks for ENH1350EXT, ENS500-AC and ENS620EXT units and check EnGenius for firmware newer than the 20241118 build, since no fixed version is confirmed and the vendor has been unresponsive. Until a patch is available, avoid exposing the devices' admin interface to the internet and limit administrative access to trusted operators, because exploitation requires valid admin credentials. Monitor for suspicious requests to /admin/network/diag_traceroute containing shell metacharacters or unexpected outbound activity from the APs.