CVE-2025-34035

EnGenius EnShare Cloud Service 1.4.11 and earlier has an OS command injection flaw (CWE-78) in the usbinteract.cgi script. The path parameter is not properly sanitized, so an unauthenticated remote attacker can inject shell commands that execute as root and fully compromise the device. Affected products are EnGenius ESR300, ESR350, ESR600, ESR900, ESR1200, ESR1750, and EPG5000 firmware that include that EnShare version. Public exploit references exist, and the Shadowserver Foundation reported exploitation evidence on 2024-12-05 UTC. Related reporting describes malware such as ClingSTUN turning unpatched IoT devices into persistent proxy nodes, so internet-exposed units should be treated as potentially compromised.

What to do: Install the latest EnGenius firmware for each affected model if it replaces EnShare Cloud Service 1.4.11 or earlier; retire or isolate devices that no longer receive updates. Until patched, block internet access to the web interface and usbinteract.cgi and allow management only from a trusted network. Because exploitation has been observed and commands run as root, check devices for unexpected processes, proxy or backdoor activity, and unauthorized configuration changes.