High severity · published Nov 25, 2024
CVE-2024-11657
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection
7.2
CVSS
29.1%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of the file /admin/network/diag_nslookup. The manipulation of the argument diag_nslookup leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)29.1% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
ENH1350EXT · EnGenius
20241118 · source: vendor, CISA
EN
ENS500-AC · EnGenius
20241118 · source: vendor, CISA
EN
ENS620EXT · EnGenius
20241118 · source: vendor, CISA
EF
Enh1350ext Firmware · Engeniustech
All versions, or not specified · source: NVD
EF
Ens500-ac Firmware · Engeniustech
All versions, or not specified · source: NVD
EF
Ens620ext Firmware · Engeniustech
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11657
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11657
Exploit
https://k9u7kv33ub.feishu.cn/wiki/RURswTkepiuKCzkGMd2cA1M2nNc
Permissions Required
https://vuldb.com/?ctiid.285978
Third Party Advisory
https://vuldb.com/?id.285978
Third Party Advisory
https://vuldb.com/?submit.446640
More from ENH1350EXT
7.2
CVE-2024-11659
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injection
7.2
CVE-2024-11658
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection
7.2
CVE-2024-11656
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injection
7.2
CVE-2024-11655
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injection
7.2
CVE-2024-11654
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection