CVE-2024-11654 in ENH1350EXT
Summary
by MITRE • 11/25/2024
A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/11/2024
This critical vulnerability exists in EnGenius network equipment models including ENH1350EXT ENS500-AC and ENS620EXT all versions up to 20241118. The flaw resides in the administrative network diagnostic component located at /admin/network/diag_traceroute6 which processes user-supplied input without adequate sanitization. The specific vulnerability manifests when the diag_traceroute6 argument is manipulated, creating a command injection opportunity that allows arbitrary code execution on the affected devices. This represents a fundamental failure in input validation and output encoding practices that directly violates established security principles.
The technical implementation of this vulnerability follows a classic command injection pattern where untrusted input flows directly into system execution contexts. When administrators or attackers submit malicious payloads through the diag_traceroute6 parameter, the system fails to properly escape or validate the input before incorporating it into shell commands. This allows attackers to append additional commands that execute with the privileges of the web application process, typically root or administrative level access. The vulnerability's remote exploitability means that attackers can trigger the injection from outside the network perimeter without requiring physical access or prior authentication.
The operational impact of this vulnerability is severe and multifaceted across enterprise and small business networks. Attackers can leverage this command injection to gain complete control over affected devices, potentially establishing persistent backdoors, exfiltrating sensitive network information, or using the compromised devices as launch points for further attacks within the network. The vulnerability affects network infrastructure devices that typically operate with high privileges and may control routing, firewall rules, and network segmentation policies. This aligns with ATT&CK technique T1059.001 for command and script interpreters and T1078.004 for valid accounts, as attackers can use compromised devices to maintain access and move laterally through networks.
The security implications extend beyond immediate device compromise to include potential disruption of network services and data integrity breaches. Organizations utilizing these EnGenius devices face significant risk of unauthorized network access, especially since the vulnerability affects commonly deployed enterprise and small office network equipment. The fact that the exploit has been publicly disclosed without vendor response creates an urgent security concern, as attackers can immediately leverage this knowledge to target vulnerable installations. This vulnerability also demonstrates poor security practices in the vendor's development lifecycle, particularly in the absence of input validation controls and proper security testing before product release. According to CWE classification, this represents CWE-77 and CWE-78, which specifically address command injection vulnerabilities through improper input handling and shell command execution. Organizations should implement immediate network segmentation, disable unnecessary administrative services, and monitor for suspicious network activity. The lack of vendor response to early disclosure further compounds the risk, suggesting potential vendor negligence in security maintenance and vulnerability remediation processes.