CVE-2024-11654

CVE-2024-11654 is a command injection flaw in the IPv6 traceroute diagnostic feature of three EnGenius wireless access points: ENH1350EXT, ENS500-AC and ENS620EXT. It is triggered by sending a manipulated diag_traceroute6 parameter to the /admin/network/diag_traceroute6 endpoint; per the CVSS 4.0 vector the attack is remote but requires high (administrator-level) privileges, and no user interaction is needed. Successful exploitation lets the attacker run arbitrary operating-system commands on the access point with the web interface's privileges, enabling device takeover, traffic manipulation or use as a pivot into the surrounding network. Anyone running affected firmware on these three models — all builds up to and including 20241118 — is exposed, and the vendor was contacted about the disclosure but did not respond, so no fix is confirmed in the available data. A public proof-of-concept exists, and the 29.1% EPSS score (98th percentile) indicates an elevated probability of exploitation attempts within 30 days, though the flaw is not yet in CISA's KEV catalog.

What to do: Inventory deployments of ENH1350EXT, ENS500-AC and ENS620EXT and check firmware builds, since everything up to and including 20241118 is affected and no patched release is documented because the vendor did not respond — monitor EnGenius support channels for a fix rather than assuming one is available. In the meantime, restrict the admin web interface to trusted management networks and harden/rotate administrator credentials, as the flaw requires admin access to trigger. Given the 29.1% EPSS (98th percentile), prioritize hardening and monitoring of any internet-facing units.