CVE-2024-11658 in ENH1350EXT
Summary
by MITRE • 11/25/2024
A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/network/ajax_getChannelList. The manipulation of the argument countryCode leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/11/2024
This critical vulnerability exists in EnGenius wireless access point devices including the ENH1350EXT ENS500-AC and ENS620EXT models with firmware versions up to 20241118. The flaw resides in the administrative network component specifically within the /admin/network/ajax_getChannelList file which handles channel listing requests for wireless network configuration. The vulnerability is classified as command injection due to improper input validation of the countryCode parameter, allowing attackers to inject malicious commands that execute with administrative privileges on the affected devices. This represents a severe security weakness that directly violates the principle of least privilege and demonstrates inadequate input sanitization practices.
The technical exploitation occurs through remote manipulation of the countryCode argument which is processed without proper validation or sanitization. When an attacker submits malicious input through this parameter, the system fails to properly escape or validate the input before processing, enabling arbitrary command execution. This type of vulnerability maps directly to CWE-77 which defines command injection flaws where user-supplied data is directly incorporated into system commands without proper sanitization. The attack vector is entirely remote, meaning no physical access or local network presence is required to exploit the vulnerability, making it particularly dangerous for enterprise and consumer deployments.
The operational impact of this vulnerability is severe as it provides attackers with full administrative control over affected wireless access points. This includes the ability to modify network configurations, access wireless client data, redirect traffic, and potentially use the compromised devices as entry points for further network infiltration. The vulnerability affects wireless infrastructure that typically serves as a critical network component, making it a prime target for attackers seeking persistent access or network disruption. Organizations using these devices face significant risk of unauthorized network access, data breaches, and potential compromise of entire wireless networks. The fact that this exploit has been publicly disclosed and is actively being used increases the urgency for immediate remediation.
Mitigation strategies should prioritize immediate firmware updates from EnGenius if available, though the vendor's lack of response to early disclosure concerns suggests limited immediate support. Network segmentation and firewall rules should be implemented to restrict access to administrative interfaces, particularly blocking direct access to the vulnerable ajax_getChannelList endpoint. Organizations should conduct comprehensive network scans to identify all affected devices and implement monitoring for unusual network traffic patterns that might indicate exploitation attempts. Additionally, the principle of defense in depth should be applied by implementing network access controls, intrusion detection systems, and regular security assessments. This vulnerability also highlights the importance of secure coding practices and input validation as outlined in the OWASP Top Ten and MITRE ATT&CK framework's command and control techniques, where such vulnerabilities are often leveraged for persistent access and lateral movement within compromised networks.