PT-2024-31500 · Engenius · Engenius Enh1350Ext

Edward Warren · Published 2024-10-24 · Updated 2026-01-06 · CVE-2024-45242

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2 c1.9.51

Description The issue allows for OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During initial setup, the device creates an open unsecured network with default admin panel credentials of admin/admin. An attacker in proximity to the Wi-Fi network can exploit this to execute arbitrary OS commands with root-level permissions.

Recommendations For EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2 c1.9.51, consider changing the default admin credentials immediately after setup and restricting access to the Ping or Speed Test utility until a patch is available. As a temporary workaround, avoid using the device's default credentials and ensure the admin panel is secured as soon as possible after initial setup.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-45242

Affected Products

Engenius Enh1350Ext

References · 5

• 🔥 https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242_Extended_Report.pdf · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45242 · Security Note
• https://twitter.com/ET_Labs/status/2008657708631887990 · Twitter Post
• https://t.me/cvedetector/8847 · Telegram Post