Critical severity · published Jun 24, 2025
CVE-2025-34035
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
9.8
CVSS
24.8%
EPSS
No
On KEV
Description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)24.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
EnShare IoT Gigabit Cloud Service · EnGenius
through 1.4.11 · source: vendor
EF
Epg5000 Firmware · Engeniustech
1.2.0; 1.3.0; 1.3.2; 1.3.3; 1.3.3.17; 1.3.7.20; +1 more · source: NVD
EF
Esr1200 Firmware · Engeniustech
1.1.0; 1.3.1.34; 1.4.1; 1.4.3; 1.4.5 · source: NVD
EF
Esr1750 Firmware · Engeniustech
1.1.0; 1.2.2.27; 1.3.0; 1.3.1.34; 1.4.0; 1.4.1; +2 more · source: NVD
EF
Esr300 Firmware · Engeniustech
1.1.0.28; 1.3.1.42; 1.4.0; 1.4.1.28; 1.4.2; 1.4.7; +1 more · source: NVD
EF
Esr350 Firmware · Engeniustech
1.1.0.29; 1.3.1.41; 1.4.0; 1.4.2; 1.4.5; 1.4.9; +1 more · source: NVD
EF
Esr600 Firmware · Engeniustech
1.1.0.50; 1.2.1.46; 1.3.1.63; 1.4.0.23; 1.4.1; 1.4.2; +4 more · source: NVD
EF
Esr900 Firmware · Engeniustech
1.1.0; 1.2.2.23; 1.3.0; 1.3.1.26; 1.3.5.18; 1.4.0; +2 more · source: NVD
Affected product
EI
EnShare IoT Gigabit Cloud Service
EnGenius
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34035
Exploit
https://cxsecurity.com/issue/WLB-2017060050
Broken Link
https://packetstormsecurity.com/files/142792
Third Party Advisory
https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service
Exploit
https://www.exploit-db.com/exploits/42114
Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php