CVE-2025-34035 EnGenius EnShare IoT Gigabit Cloud Service Command Injection
Unauthenticated attackers can inject shell commands via the path parameter in usbinteract.cgi, executing code with root privileges on EnGenius EnShare devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34035?
CVE-2025-34035 is a critical command injection vulnerability in EnGenius EnShare IoT Gigabit Cloud Service, published on 24 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Weakness: CWE-78
Which versions are affected by CVE-2025-34035?
It affects 7 products.
Products include Engeniustech Epg5000 Firmware, Engeniustech Esr1200 Firmware, Engeniustech Esr1750 Firmware, Engeniustech Esr300 Firmware, Engeniustech Esr350 Firmware, Engeniustech Esr600 Firmware and 1 more.
How do I fix CVE-2025-34035?
No fix has been published for CVE-2025-34035 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-34035 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34035 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-xv32-fpqh-v67r.