CVE-2019-11353
📋 TL;DR
CVE-2019-11353 allows remote attackers to execute arbitrary commands on EnGenius EWS660AP routers by injecting malicious parameters into the built-in ping and traceroute utilities. This vulnerability affects all users running firmware version 2.0.284 on these specific router models. Successful exploitation gives attackers full control over the affected device.
💻 Affected Systems
- EnGenius EWS660AP
📦 What is this software?
Ews660ap Firmware by Engeniustech
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to intercept network traffic, install persistent backdoors, pivot to internal networks, or use the device for botnet activities.
Likely Case
Attackers gain shell access to execute commands, potentially stealing credentials, modifying configurations, or disrupting network services.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
Exploitation requires network access to the router's web interface. Multiple public references demonstrate command injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware later than 2.0.284
Vendor Advisory: https://www.engeniustech.com/engenius-products/managed-outdoor-wireless-ews660ap/
Restart Required: Yes
Instructions:
1. Download latest firmware from EnGenius website. 2. Log into router web interface. 3. Navigate to System > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for upgrade to complete and router to reboot.
🔧 Temporary Workarounds
Disable Web Interface Access
linuxRestrict access to router web interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Segment router on isolated network segment with strict firewall rules
- Implement network monitoring for unusual command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System > Status. If version is 2.0.284, device is vulnerable.Check Version:
curl -s http://router-ip/status.cgi | grep firmwareVerify Fix Applied:
After firmware upgrade, verify version shows higher than 2.0.284. Test ping/traceroute functionality to ensure command injection is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple ping/traceroute requests with unusual parameters
- Web interface access from unexpected IP addresses
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control communication
SIEM Query:
source="router-logs" AND ("ping" OR "traceroute") AND command="*;*" OR command="*|*" OR command="*`*"🔗 References
- https://securityshards.wordpress.com/2019/04/21/cve-2019-11353-engenius-ews660ap-arbitrary-code-execution/
- https://www.engeniustech.com/engenius-products/managed-outdoor-wireless-ews660ap/
- https://securityshards.wordpress.com/2019/04/21/cve-2019-11353-engenius-ews660ap-arbitrary-code-execution/
- https://www.engeniustech.com/engenius-products/managed-outdoor-wireless-ews660ap/
