CVE-2024-11658

Three EnGenius access point models (ENH1350EXT, ENS500-AC, ENS620EXT) contain a command injection flaw in the admin interface's /admin/network/ajax_getChannelList function, where the countryCode argument is not properly sanitized. An attacker with access to the device's management interface — the CVSS 4.0 vector (PR:H) indicates admin-level authentication is required — submits a crafted countryCode value, causing arbitrary OS command execution on the access point. Successful exploitation can allow the attacker to run commands on the device, alter its configuration, disrupt wireless service, or pivot into the network behind it; the CVSS 4.0 base score of 5.1 (medium) reflects low individual impact on confidentiality, integrity and availability. Any organization running ENH1350EXT, ENS500-AC or ENS620EXT firmware up to the 2024-11-18 builds is affected. A public proof of concept exists and the flaw carries an elevated 29.1% EPSS exploitation probability (98th percentile), but it is not yet in CISA KEV and no confirmed in-the-wild exploitation is known; the vendor was contacted but did not respond, so no fixed firmware has been confirmed.

What to do: Because the vendor did not respond to the disclosure, no fixed firmware version is confirmed — check EnGenius's support/download pages for updated firmware for ENH1350EXT, ENS500-AC and ENS620EXT and apply it if released. In the meantime, do not expose the devices' admin interface to the WAN (restrict it to a management VLAN or firewall it), use strong admin credentials, and consider validating or constraining the countryCode parameter if custom filtering is possible. Review the public proof of concept to confirm whether your devices parse input through ajax_getChannelList, and monitor devices for unexpected configuration changes or suspicious processes.