PT-2024-17163 · Engenius · Engenius Enh1350Ext+2
Liutong
·
Published
2024-11-25
·
Updated
2024-12-10
·
CVE-2024-11654
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
EnGenius ENH1350EXT versions up to 20241118
EnGenius ENS500-AC versions up to 20241118
EnGenius ENS620EXT versions up to 20241118
Description
A critical vulnerability has been found in EnGenius devices, affecting an unknown part of the file
/admin/network/diag traceroute6. The manipulation of the diag traceroute6 argument leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.Recommendations
For EnGenius ENH1350EXT versions up to 20241118, consider disabling access to the
/admin/network/diag traceroute6 endpoint until a patch is available.
For EnGenius ENS500-AC versions up to 20241118, consider disabling access to the /admin/network/diag traceroute6 endpoint until a patch is available.
For EnGenius ENS620EXT versions up to 20241118, consider disabling access to the /admin/network/diag traceroute6 endpoint until a patch is available.
As a temporary workaround, consider restricting the use of the diag traceroute6 argument in the affected endpoint to minimize the risk of exploitation.Exploit
Fix
Special Elements Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Engenius Enh1350Ext
Engenius Ens500-Ac
Engenius Ens620Ext