CVE-2024-11659

The CVE-2024-11659 issue affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT (firmware up to 2024-11-18). The root cause is an input manipulation vulnerability in the /admin/network/diag_iperf endpoint, where altering the iperf argument enables command injection. This can be triggered remotely ...

CVE-2024-11653

CVE-2024-11653 affects EnGenius ENH1350EXT, ENS500-AC and ENS620EXT (up to 2024-11-18). The vulnerability is a command injection in the /admin/network/diag_traceroute endpoint via manipulation of the diag_traceroute parameter. It can be exploited remotely. Public exploit has been disclosed; vendo...

CVE-2024-11657

CVE-2024-11657 affects EnGenius ENH1350EXT, ENS500-AC and ENS620EXT. Affected is an unknown function in the file /admin/network/diag_nslookup; manipulation of the diag_nslookup argument leads to command injection. Exploitation is possible remotely, with public disclosure of the exploit. Multiple ...

CVE-2024-11651

The CVE-2024-11651 vulnerability affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT (firmware up to 20241118). Affected is an unknown function in /admin/network/wifi_schedule; manipulating wifi_schedule_day_em_5 leads to remote command injection. Public exploit exists; vendor did not respond t...

CVE-2024-11655

CVE-2024-11655 affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT (firmware up to 2024-11-18). The vulnerability targets the file /admin/network/diag_pinginterface and arises from manipulation of the diag_ping argument, resulting in command injection. The issue is exploitable remotely and has ...

CVE-2024-11656

CVE-2024-11656 affects EnGenius ENH1350EXT, ENS500-AC and ENS620EXT (up to 20241118). The issue is a command-injection in the /admin/network/diag_ping6 handling, triggered by manipulation of the diag_ping6 argument, potentially exploitable remotely. Public exploit appears to have been disclosed. ...

CVE-2024-11658

CVE-2024-11658 affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT (up to 20241118). The vulnerability stems from an injection in the file /admin/network/ajax_getChannelList where manipulating the countryCode parameter leads to command injection, exploitable remotely. Public exploit appears to ...

CVE-2024-11654

The CVE-2024-11654 entry applies to EnGenius ENH1350EXT, ENS500-AC and ENS620EXT (up to 2024-11-18). The vulnerability affects an unspecified part of the file /admin/network/diag_traceroute6, where manipulation of the diag_traceroute6 parameter yields a command-injection flaw. It is exploitable r...

CVE-2024-11652

The CVE-2024-11652 entry affects EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT (firmware up to 2024-11-18). The vulnerability targets an unknown functionality in the file /admin/sn_package/sn_https, where manipulating the argument https_enable yields a remote command injection. Public exploit/dis...