CVE-2024-11655
📋 TL;DR
This critical vulnerability allows remote attackers to execute arbitrary commands on affected EnGenius networking devices by injecting malicious input into the diag_ping parameter. Attackers can potentially gain full control of the device without authentication. All users of affected EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT devices are at risk.
💻 Affected Systems
- EnGenius ENH1350EXT
- EnGenius ENS500-AC
- EnGenius ENS620EXT
📦 What is this software?
Enh1350ext Firmware by Engeniustech
Ens500 Ac Firmware by Engeniustech
Ens620ext Firmware by Engeniustech
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network pivoting to internal systems, and data exfiltration.
Likely Case
Device takeover for botnet recruitment, network disruption, or credential harvesting from connected systems.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details are publicly available and the vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check EnGenius support portal for firmware updates. 2. Download latest firmware. 3. Backup configuration. 4. Upload firmware via web interface. 5. Reboot device.
🔧 Temporary Workarounds
Network Access Control
allBlock external access to device administration interface
Firewall Rule
allBlock access to /admin/network/diag_pinginterface endpoint
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Disable remote administration and require VPN for management access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under System > Firmware. If version date is 20241118 or earlier, device is vulnerable.Check Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version shows date after 20241118 and test that diag_ping parameter no longer accepts command injection.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin/network/diag_pinginterface
- Suspicious command execution in system logs
Network Indicators:
- Unexpected outbound connections from device
- Traffic to known malicious IPs
SIEM Query:
source="engenius-device" AND (url="/admin/network/diag_pinginterface" OR cmd="ping" AND args CONTAINS ";" OR "|" OR "`")