CVE-2025-34035: Engeniustech ESR300 Firmware RCE Vulnerability

CVE-2025-34035 Overview

CVE-2025-34035 is an unauthenticated OS command injection vulnerability in the EnGenius EnShare Cloud Service shipped with multiple EnGenius router and gateway firmware images. The usbinteract.cgi script does not sanitize user-supplied input in the path parameter before passing it to a shell. Remote attackers can inject arbitrary shell commands that execute as root, resulting in full device compromise. The Shadowserver Foundation observed exploitation activity targeting affected EnShare endpoints on 2024-12-05 UTC. The flaw is tracked under CWE-78 and carries a CVSS v4.0 base score of 10.0.

Critical Impact
Unauthenticated network-accessible command injection in usbinteract.cgi allows attackers to gain root-level remote code execution on affected EnGenius routers.

Affected Products

EnGenius ESR300, ESR350, ESR600, ESR900, ESR1200, and ESR1750 router firmware (EnShare Cloud Service 1.4.11 and earlier)
EnGenius EPG5000 gateway firmware (EnShare Cloud Service 1.4.11 and earlier)
All firmware revisions enumerated in the NVD CPE list that bundle the vulnerable usbinteract.cgi handler

Discovery Timeline

2024-12-05 - Shadowserver Foundation observed in-the-wild exploitation activity
2025-06-24 - CVE-2025-34035 published to NVD
2025-11-20 - Last updated in NVD database

Technical Details for CVE-2025-34035

Vulnerability Analysis

The EnShare Cloud Service exposes a CGI endpoint at usbinteract.cgi that interacts with USB storage attached to the device. The handler accepts a path query parameter and concatenates it into a shell command without input validation or argument quoting. An attacker who can reach the device web interface can append shell metacharacters such as ;, |, or backticks to the parameter to break out of the intended command context. The injected commands inherit the privileges of the parent CGI process, which on these EnGenius devices runs as root. Successful exploitation grants the attacker arbitrary command execution, persistent device implantation, credential extraction, and pivoting into adjacent network segments.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The usbinteract.cgi script passes attacker-controlled input from the path HTTP parameter directly to a system shell invocation. No allow-list, escaping, or use of safer APIs such as execve with separated arguments is applied before execution.

Attack Vector

Exploitation requires only network reachability to the device HTTP service. No authentication, user interaction, or prior foothold is needed. An attacker sends a crafted HTTP GET or POST request to usbinteract.cgi containing shell metacharacters in the path parameter. The web server hands the value to the shell, and the appended command executes immediately as root. Devices exposed to the internet, or reachable through a compromised internal host, are equally at risk.

No verified public exploit code is included in this advisory. Technical details and historical proof-of-concept references are available in the VulnCheck Advisory for EnGenius, Exploit-DB #42114, and Zero Science Vulnerability ZSL-2017-5413.

Detection Methods for CVE-2025-34035

Indicators of Compromise

HTTP requests to usbinteract.cgi containing shell metacharacters (;, |, &, backticks, $() in the path parameter
Outbound connections from EnGenius devices to unknown hosts, particularly TFTP, HTTP, or reverse-shell endpoints initiated by httpd or CGI child processes
Unexpected new files or scripts in writable directories such as /tmp or /var/tmp on the device
Modified or newly created cron entries and startup scripts on the router

Detection Strategies

Inspect web access logs and upstream firewall logs for requests to usbinteract.cgi that include URL-encoded shell metacharacters
Use network IDS signatures matching the path= parameter against patterns such as %3B, %7C, %24%28, or literal ;
Compare device firmware checksums and configuration baselines to detect tampering on affected EnGenius models

Monitoring Recommendations

Forward router and perimeter logs to a centralized SIEM and alert on anomalous outbound traffic from edge appliances
Track DNS queries originating from management VLANs that contain newly registered or low-reputation domains
Monitor for repeated requests to usbinteract.cgi from a single source, which may indicate scanning or exploitation attempts

How to Mitigate CVE-2025-34035

Immediate Actions Required

Block external access to the device web interface and the usbinteract.cgi endpoint at the perimeter
Disable the EnShare feature on affected EnGenius routers and gateways if the service is not required
Inventory all EnGenius ESR and EPG devices and identify any unit running EnShare Cloud Service 1.4.11 or earlier
Treat any internet-exposed affected device as potentially compromised and rebuild from a known-good firmware image

Patch Information

No vendor patch URL is listed in the NVD entry for this advisory. The affected EnGenius ESR and EPG product lines are largely end-of-life, and updated firmware addressing this specific defect has not been published by the vendor at the time of this writing. Operators should consult the VulnCheck Advisory for EnGenius for current vendor guidance and consider replacing affected hardware with supported devices.

Workarounds

Disable the EnShare/USB sharing service through the device administrative interface to remove the vulnerable CGI handler from the request path
Restrict management plane access using ACLs so that only trusted internal hosts can reach the router HTTP service
Place affected devices behind a separate firewall and apply IPS rules that drop requests to usbinteract.cgi containing shell metacharacters
Replace end-of-life EnGenius hardware with currently supported models that receive security updates

bash

# Configuration example: block external access to the vulnerable CGI on an upstream firewall
# (iptables example - adapt to your environment)
iptables -A FORWARD -p tcp --dport 80 -m string --algo bm \
  --string "usbinteract.cgi" -j DROP
iptables -A FORWARD -p tcp --dport 443 -m string --algo bm \
  --string "usbinteract.cgi" -j DROP