https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-34035.htmlhttps://patchthecve.com/cve/CVE-2025-34035.htmlWed, 17 Jun 2026 09:13:20 +0000CRITICAL 9.8: An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commandhttps://patchthecve.com/cve/CVE-2025-28371.htmlhttps://patchthecve.com/cve/CVE-2025-28371.htmlWed, 17 Jun 2026 09:04:42 +0000MEDIUM 6.5: EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.https://patchthecve.com/cve/CVE-2024-31976.htmlhttps://patchthecve.com/cve/CVE-2024-31976.htmlWed, 17 Jun 2026 07:29:02 +0000HIGH 8.0: EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter.https://patchthecve.com/cve/CVE-2024-11659.htmlhttps://patchthecve.com/cve/CVE-2024-11659.htmlWed, 17 Jun 2026 06:58:10 +0000MEDIUM 4.7: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_iperf. The manipulation of the argument iperf leads to command injection. The attack may be launchhttps://patchthecve.com/cve/CVE-2024-11658.htmlhttps://patchthecve.com/cve/CVE-2024-11658.htmlWed, 17 Jun 2026 06:58:10 +0000MEDIUM 4.7: A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/network/ajax_getChannelList. The manipulation of the argument countryCode leads to command injectionhttps://patchthecve.com/cve/CVE-2024-11657.htmlhttps://patchthecve.com/cve/CVE-2024-11657.htmlWed, 17 Jun 2026 06:58:10 +0000MEDIUM 4.7: A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of the file /admin/network/diag_nslookup. The manipulation of the argument diag_nslookup leads to command injection. It is possible to launch thttps://patchthecve.com/cve/CVE-2024-11656.htmlhttps://patchthecve.com/cve/CVE-2024-11656.htmlWed, 17 Jun 2026 06:58:10 +0000MEDIUM 4.7: A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unknown processing of the file /admin/network/diag_ping6. The manipulation of the argument diag_ping6 leads to command injection. The attack may bhttps://patchthecve.com/cve/CVE-2024-11655.htmlhttps://patchthecve.com/cve/CVE-2024-11655.htmlWed, 17 Jun 2026 06:58:09 +0000MEDIUM 4.7: A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the file /admin/network/diag_pinginterface. The manipulation of the argument diag_ping leads to command injection. The attack can be initiated rhttps://patchthecve.com/cve/CVE-2024-11654.htmlhttps://patchthecve.com/cve/CVE-2024-11654.htmlWed, 17 Jun 2026 06:58:09 +0000MEDIUM 4.7: A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate thehttps://patchthecve.com/cve/CVE-2024-11653.htmlhttps://patchthecve.com/cve/CVE-2024-11653.htmlWed, 17 Jun 2026 06:58:09 +0000MEDIUM 4.7: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_traceroute. The manipulation of the argument diag_traceroute leads to command injection. The ahttps://patchthecve.com/cve/CVE-2024-11652.htmlhttps://patchthecve.com/cve/CVE-2024-11652.htmlWed, 17 Jun 2026 06:58:09 +0000MEDIUM 4.7: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sn_package/sn_https. The manipulation of the argument https_enable leads to command injection. Thehttps://patchthecve.com/cve/CVE-2024-11651.htmlhttps://patchthecve.com/cve/CVE-2024-11651.htmlWed, 17 Jun 2026 06:58:09 +0000MEDIUM 4.7: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function of the file /admin/network/wifi_schedule. The manipulation of the argument wifi_schedule_day_em_5 leads to command injection. It is possible thttps://patchthecve.com/cve/CVE-2024-31975.htmlhttps://patchthecve.com/cve/CVE-2024-31975.htmlWed, 17 Jun 2026 07:29:02 +0000MEDIUM 4.8: EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button.