CVE-2024-11657

CVE-2024-11657 is a command injection flaw in the EnGenius ENH1350EXT, ENS500-AC and ENS620EXT access point firmware (all builds up to 20241118), triggered via the diag_nslookup argument passed to the /admin/network/diag_nslookup endpoint. The attack is launched remotely, and the CVSS 4.0 vector indicates it requires high privileges (i.e., valid admin-level access to the device's web interface), yielding limited-volume confidentiality, integrity and availability impact per the score. An attacker who is authenticated as an administrator (or who has obtained admin credentials) can inject and execute operating-system commands on the device. All users running affected firmware versions of these three EnGenius models are in scope. A proof-of-concept exploit has been published publicly, EPSS puts the 30-day exploitation probability at 29.1% (98th percentile), and the vendor was notified early but has not responded, so no confirmed fix is available yet.

What to do: Because the vendor has not responded, no fixed firmware version is confirmed — monitor EnGenius support channels for an updated release for these three models. Until a patch ships, restrict the device admin interface to trusted networks or VPN access and ensure strong, unique admin credentials, since the CVSS vector indicates admin privileges are required to exploit. Given the published PoC and elevated EPSS (29.1%), check device logs for unexpected requests to /admin/network/diag_nslookup.