PT-2024-26872 · Engenius · Engenius Enstation5-Ac

Edward Warren · Published 2024-10-30 · Updated 2024-11-01 · CVE-2024-36060

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EnGenius EnStation5-AC A8J-ENS500AC version 1.0.0

Description The issue allows blind OS command injection via shell metacharacters in the Ping and Speed Test parameters. This can potentially be exploited to execute unauthorized commands on the device.

Recommendations For EnGenius EnStation5-AC A8J-ENS500AC version 1.0.0, as a temporary workaround, consider restricting access to the Ping and Speed Test features until a patch is available. Avoid using shell metacharacters in these parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-36060

Affected Products

Engenius Enstation5-Ac

References · 4

• 🔥 https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-36060 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36060 · Security Note
• https://t.me/cvedetector/9443 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1851837385711014033 · Twitter Post