CVE-2024-11657
📋 TL;DR
This critical vulnerability allows remote attackers to execute arbitrary commands on affected EnGenius networking devices by injecting malicious input into the diag_nslookup parameter. The attack can be performed without authentication and affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT devices with firmware up to November 18, 2024.
💻 Affected Systems
- EnGenius ENH1350EXT
- EnGenius ENS500-AC
- EnGenius ENS620EXT
📦 What is this software?
Enh1350ext Firmware by Engeniustech
Ens500 Ac Firmware by Engeniustech
Ens620ext Firmware by Engeniustech
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, exfiltrate data, or use device as botnet member.
Likely Case
Attacker gains shell access to device, modifies configurations, intercepts network traffic, or uses device for further attacks.
If Mitigated
Attack blocked at network perimeter; device isolated and monitored for suspicious activity.
🎯 Exploit Status
Exploit details publicly disclosed; simple HTTP request with command injection payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact EnGenius support for firmware updates. Check vendor website regularly for security advisories.
🔧 Temporary Workarounds
Network Isolation
linuxBlock access to admin interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s ! TRUSTED_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! TRUSTED_NETWORK -j DROP
Disable Web Interface
linuxTemporarily disable web administration if not needed
killall httpd
chmod 000 /www/cgi-bin/admin/network/diag_nslookup
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to /admin/network/diag_nslookup
🔍 How to Verify
Check if Vulnerable:
Test by sending HTTP POST request to /admin/network/diag_nslookup with command injection payload in diag_nslookup parameterCheck Version:
Check web interface System Status page or ssh into device and run 'cat /etc/version'Verify Fix Applied:
Test same payload after mitigation; should receive error or no command execution📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin/network/diag_nslookup with shell metacharacters
- Unusual process execution in device logs
- Failed authentication attempts followed by diag_nslookup access
Network Indicators:
- HTTP traffic to device on port 80/443 containing 'diag_nslookup' parameter with pipe (|), semicolon (;), or backtick (`) characters
SIEM Query:
source="device_logs" AND uri_path="/admin/network/diag_nslookup" AND (request_body="*;*" OR request_body="*|*" OR request_body="*`*")