CVE-2024-11654
📋 TL;DR
This critical vulnerability in EnGenius wireless access points allows remote attackers to execute arbitrary commands via command injection in the traceroute6 diagnostic function. Attackers can compromise affected devices without authentication, potentially gaining full control. All users of vulnerable EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT devices are affected.
💻 Affected Systems
- EnGenius ENH1350EXT
- EnGenius ENS500-AC
- EnGenius ENS620EXT
📦 What is this software?
Enh1350ext Firmware by Engeniustech
Ens500 Ac Firmware by Engeniustech
Ens620ext Firmware by Engeniustech
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network pivoting, credential theft, and disruption of network services.
Likely Case
Unauthorized command execution leading to device configuration changes, network disruption, or installation of malware for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit details are publicly disclosed and the vulnerability requires minimal technical skill to exploit. Remote exploitation without authentication makes this highly attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Monitor EnGenius security advisories for updates.
🔧 Temporary Workarounds
Disable web administration interface
allDisable the web administration interface if not required, or restrict access to management interfaces
Network segmentation and firewall rules
allIsolate affected devices in separate network segments and implement strict firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit access to device management interfaces
- Monitor device logs for suspicious traceroute6 activity and command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at System > Status > Firmware Version. If version date is 20241118 or earlier, device is vulnerable.Check Version:
No CLI command available. Use web interface: System > Status > Firmware VersionVerify Fix Applied:
No fix available to verify. Monitor for vendor firmware updates.📡 Detection & Monitoring
Log Indicators:
- Unusual traceroute6 requests in web server logs
- Suspicious command execution patterns in system logs
- Multiple failed authentication attempts followed by traceroute6 requests
Network Indicators:
- Unexpected outbound connections from access points
- Traffic to suspicious external IPs from management interfaces
- Unusual HTTP POST requests to /admin/network/diag_traceroute6
SIEM Query:
source="apache" OR source="nginx" AND (url="/admin/network/diag_traceroute6" AND (method="POST" OR method="GET")) AND (user_agent CONTAINS "curl" OR user_agent CONTAINS "wget" OR user_agent="-")