CVE-2025-34035 is a critical (CVSS 9.8) OS command injection in EnGenius EnShare Cloud Service 1.4.11 and earlier, reachable without login and running as root. The record cites exploitation evidence from the Shadowserver Foundation. No fixed version is confirmed, so isolate affected devices.
What's affected
The record names EnGenius EnShare Cloud Service version 1.4.11 and earlier, and lists several EnGenius products: EPG5000, ESR1200, ESR1750 and ESR300 devices with their firmware. The VulnCheck advisory says the affected range remains undefined, so the earliest vulnerable version is unknown.
Neither the record nor the advisory names a fixed version or a vendor workaround. Check EnGenius support pages for your exact model and firmware.
How to check if you're exposed
List every EnGenius device on your network and open its administration page to read the model and firmware version. If a model in the list above runs EnShare 1.4.11 or earlier, treat it as vulnerable.
The script involved is usbinteract.cgi, which belongs to the USB sharing feature. If you do not use USB storage sharing or cloud sharing, check whether the feature can be switched off in the device settings. Then check whether the device management or sharing ports are reachable from outside your network. Your firewall rules and an external port scan from a trusted host will tell you.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Inventory EnGenius routers and access points and record model and firmware.
- Make sure no management or sharing service is reachable from the internet.
- Disable the USB or cloud sharing feature if you do not need it.
- Check EnGenius support for updated firmware and apply it if one is listed for your model.
- If a device cannot be patched and is end of life, plan to replace it.
- Review the device and network logs for unfamiliar outbound connections, and reset credentials if the device looks tampered with.
Why it matters
The weakness is CWE-78, OS command injection. The usbinteract.cgi script takes the path parameter and passes it on to a shell without cleaning it, so shell characters in the input become part of a command. The commands run as root, so the whole device is lost.
The record states that the Shadowserver Foundation saw exploitation evidence on 5 December 2024, and the VulnCheck advisory says it is in the VulnCheck KEV list. The record flags this CVE as not present in the CISA KEV catalogue, so say exactly which source you mean when you report it. Edge devices that nobody patches are a favourite target, which makes inventory the first job.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this CVE exploited?
The record cites exploitation evidence seen by the Shadowserver Foundation on 5 December 2024. It is not flagged in the CISA KEV data used for this post.
Is there a patch?
None is confirmed in the sources reviewed. Check EnGenius support for your model.
Sources
Last reviewed: 18 October 2026.
