CVE-2025-34035 - CVE House

Back to Database

Status published Critical CVE-2025-34035

EnGenius EnShare IoT Gigabit Cloud Service Command Injection

10 CVSS

Vulnerability Description

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34035

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Gjoko Krstic

References

More from EnGenius

View All →

EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injection

EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection

EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection

EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injection

EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injection

Affected Vendor

EnGenius

View all reports →

Affected Software

EnShare IoT Gigabit Cloud Service

Vulnerable Versions:

0

Timeline

Official Publish: June 24th, 2025

Last Modified: April 7th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel