CVE-2024-11655

CVE-2024-11655 is a remote command injection flaw (CWE-74/CWE-77) in the web management interface of EnGenius ENH1350EXT, ENS500-AC and ENS620EXT access-point firmware, in the diag_ping parameter of /admin/network/diag_pinginterface. An attacker who sends a crafted diag_ping value to that endpoint causes the device to execute arbitrary operating-system commands; the published CVSS 4.0 vector (PR:H) indicates the request must come from a high-privilege administrator session, which is why the vector scores 5.1 (medium) even though the reporting CNA classifies the flaw as critical. Command execution on these embedded access points typically lets an attacker reconfigure the device, tamper with traffic on the networks it bridges, or move laterally into the connected networks. All firmware builds dated 20241118 or earlier on the three models are affected; the vendor was notified early about the disclosure but did not respond, and no fixed version is identified in the available data. A public proof of concept has been published (https://k9u7kv33ub.feishu.cn/wiki/PpM6w3TF8ilK3Ek5RLqcLPUrn6c), the flaw is not yet in CISA KEV, and EPSS assigns a 28.8% probability (98th percentile) of exploitation within 30 days, so defenders should treat exploitation as likely.

What to do: Inventory environments for ENH1350EXT, ENS500-AC and ENS620EXT access points and restrict the management interface to trusted networks (management VLAN/VPN, WAN-side management disabled) until a fixed firmware is released, since the vendor has not yet published one and affected builds run through 20241118. Use the public PoC to hunt for signs of exploitation, such as unexpected diagnostic ping activity or unexplained configuration changes, and monitor for a vendor advisory or updated firmware.