CVE-2025-34035 PoC — EnGenius EnShare Cloud Service 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34035.yaml

Associated Vulnerability

Title:EnGenius EnShare Cloud Service 安全漏洞 (CVE-2025-34035)
Description:EnGenius EnShare Cloud Service是美国EnGenius公司的一款云端网络管理平台。 EnGenius EnShare Cloud Service 1.4.11及之前版本存在安全漏洞，该漏洞源于usbinteract.cgi脚本中path参数未清理导致OS命令注入攻击。

Description

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.

File Snapshot


 id: CVE-2025-34035

info:
  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!