CVE-2025-28371
📋 TL;DR
This vulnerability allows attackers to change the administrator password on EnGenius ENH500 access points without knowing the current password. Attackers with network access to the device's management interface can take full administrative control. All organizations using the affected firmware version are vulnerable.
💻 Affected Systems
- EnGenius ENH500 AP 2T2R V3.0
📦 What is this software?
Enh500 Firmware by Engeniustech
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, traffic interception, rogue access point deployment, and lateral movement into connected networks.
Likely Case
Unauthorized administrative access allowing configuration changes, network disruption, and potential credential harvesting from connected clients.
If Mitigated
Limited to internal network attacks if management interface is not exposed to untrusted networks.
🎯 Exploit Status
Exploit requires access to the web management interface but no authentication. Proof-of-concept code is publicly available in the referenced pastebin links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check EnGenius support portal for firmware updates. 2. Download latest firmware. 3. Log into device web interface. 4. Navigate to System > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for reboot and verify version.
🔧 Temporary Workarounds
Restrict Management Interface Access
allLimit access to the device's web management interface to trusted IP addresses only
Configure firewall rules to restrict access to port 80/443 on the AP management IP
Disable Remote Management
allTurn off remote management features if not required
Navigate to System > Management > Disable 'Allow Remote Management'
🧯 If You Can't Patch
- Isolate affected APs on separate VLAN with strict firewall rules
- Implement network monitoring for unauthorized password change attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to change admin password via web interface without providing current password. If successful, device is vulnerable.Check Version:
Log into web interface and check System > Status > Firmware VersionVerify Fix Applied:
After firmware update, attempt the same password change test - it should fail without correct current password.📡 Detection & Monitoring
Log Indicators:
- Unusual password change events
- Login attempts from unexpected IP addresses
- Configuration changes without proper authentication
Network Indicators:
- HTTP POST requests to password change endpoints without authentication
- Unusual traffic patterns from AP management interface
SIEM Query:
source="ap_logs" AND (event_type="password_change" OR uri="/goform/setPassword")