CVE-2025-34035

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 22.81%
EPSS Percentile: 97.70%
CISA KEV: Not listed

Description

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: disclosure@vulncheck.com
Published: 24-Jun-2025 08:15
Last Modified: 17-Jun-2026 16:13
EPSS Date: 2026-10-13
CWE: CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

engeniustech / esr300_firmware
Version / affected range: 1.1.0.28
cpe:2.3:o:engeniustech:esr300_firmware:1.1.0.28:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.3.1.42
cpe:2.3:o:engeniustech:esr300_firmware:1.3.1.42:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.4.0
cpe:2.3:o:engeniustech:esr300_firmware:1.4.0:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.4.1.28
cpe:2.3:o:engeniustech:esr300_firmware:1.4.1.28:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.4.2
cpe:2.3:o:engeniustech:esr300_firmware:1.4.2:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.4.7
cpe:2.3:o:engeniustech:esr300_firmware:1.4.7:*:*:*:*:*:*:*
engeniustech / esr300_firmware
Version / affected range: 1.4.9
cpe:2.3:o:engeniustech:esr300_firmware:1.4.9:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.1.0.29
cpe:2.3:o:engeniustech:esr350_firmware:1.1.0.29:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.3.1.41
cpe:2.3:o:engeniustech:esr350_firmware:1.3.1.41:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.4.0
cpe:2.3:o:engeniustech:esr350_firmware:1.4.0:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.4.2
cpe:2.3:o:engeniustech:esr350_firmware:1.4.2:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.4.5
cpe:2.3:o:engeniustech:esr350_firmware:1.4.5:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.4.9
cpe:2.3:o:engeniustech:esr350_firmware:1.4.9:*:*:*:*:*:*:*
engeniustech / esr350_firmware
Version / affected range: 1.4.11
cpe:2.3:o:engeniustech:esr350_firmware:1.4.11:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.1.0.50
cpe:2.3:o:engeniustech:esr600_firmware:1.1.0.50:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.2.1.46
cpe:2.3:o:engeniustech:esr600_firmware:1.2.1.46:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.3.1.63
cpe:2.3:o:engeniustech:esr600_firmware:1.3.1.63:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.0.23
cpe:2.3:o:engeniustech:esr600_firmware:1.4.0.23:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.1
cpe:2.3:o:engeniustech:esr600_firmware:1.4.1:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.2
cpe:2.3:o:engeniustech:esr600_firmware:1.4.2:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.3
cpe:2.3:o:engeniustech:esr600_firmware:1.4.3:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.5
cpe:2.3:o:engeniustech:esr600_firmware:1.4.5:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.9
cpe:2.3:o:engeniustech:esr600_firmware:1.4.9:*:*:*:*:*:*:*
engeniustech / esr600_firmware
Version / affected range: 1.4.11
cpe:2.3:o:engeniustech:esr600_firmware:1.4.11:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.1.0
cpe:2.3:o:engeniustech:esr900_firmware:1.1.0:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.2.2.23
cpe:2.3:o:engeniustech:esr900_firmware:1.2.2.23:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.3.0
cpe:2.3:o:engeniustech:esr900_firmware:1.3.0:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.3.1.26
cpe:2.3:o:engeniustech:esr900_firmware:1.3.1.26:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.3.5.18
cpe:2.3:o:engeniustech:esr900_firmware:1.3.5.18:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.4.0
cpe:2.3:o:engeniustech:esr900_firmware:1.4.0:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.4.3
cpe:2.3:o:engeniustech:esr900_firmware:1.4.3:*:*:*:*:*:*:*
engeniustech / esr900_firmware
Version / affected range: 1.4.5
cpe:2.3:o:engeniustech:esr900_firmware:1.4.5:*:*:*:*:*:*:*
engeniustech / esr1200_firmware
Version / affected range: 1.1.0
cpe:2.3:o:engeniustech:esr1200_firmware:1.1.0:*:*:*:*:*:*:*
engeniustech / esr1200_firmware
Version / affected range: 1.3.1.34
cpe:2.3:o:engeniustech:esr1200_firmware:1.3.1.34:*:*:*:*:*:*:*
engeniustech / esr1200_firmware
Version / affected range: 1.4.1
cpe:2.3:o:engeniustech:esr1200_firmware:1.4.1:*:*:*:*:*:*:*
engeniustech / esr1200_firmware
Version / affected range: 1.4.3
cpe:2.3:o:engeniustech:esr1200_firmware:1.4.3:*:*:*:*:*:*:*
engeniustech / esr1200_firmware
Version / affected range: 1.4.5
cpe:2.3:o:engeniustech:esr1200_firmware:1.4.5:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.1.0
cpe:2.3:o:engeniustech:esr1750_firmware:1.1.0:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.2.2.27
cpe:2.3:o:engeniustech:esr1750_firmware:1.2.2.27:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.3.0
cpe:2.3:o:engeniustech:esr1750_firmware:1.3.0:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.3.1.34
cpe:2.3:o:engeniustech:esr1750_firmware:1.3.1.34:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.4.0
cpe:2.3:o:engeniustech:esr1750_firmware:1.4.0:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.4.1
cpe:2.3:o:engeniustech:esr1750_firmware:1.4.1:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.4.3
cpe:2.3:o:engeniustech:esr1750_firmware:1.4.3:*:*:*:*:*:*:*
engeniustech / esr1750_firmware
Version / affected range: 1.4.5
cpe:2.3:o:engeniustech:esr1750_firmware:1.4.5:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.2.0
cpe:2.3:o:engeniustech:epg5000_firmware:1.2.0:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.0
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.0:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.2
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.2:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.3
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.3:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.3.17
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.3.17:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.7.20
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.7.20:*:*:*:*:*:*:*
engeniustech / epg5000_firmware
Version / affected range: 1.3.9.21
cpe:2.3:o:engeniustech:epg5000_firmware:1.3.9.21:*:*:*:*:*:*:*

References

Last enrichment sync: 14-Oct-2026 09:36
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

This time, they didn’t focus on a single vulnerability but on two: command injection in the EnGenius IoT cloud service (CVE-2025-34035) and D-Link UPnP (CVE-2024-23625). ClingSTUN Linux Backdoor Abuses Public STUN Services to Control Compromised IoT Devices

CVE (30)

Malware (4)

People (1)

MITRE ATT&CK (10)

Vendors (19)

Products (14)

Tools (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.